ACTIAS

secret

Versioned credentials, resolved when the script starts.

Declare

local signing = secret "jwt-signing-key"

The handle is the value itself, resolved at declaration, once per environment. Set it with the CLI or the console; it never lives in the bundle.

actias secret <project-id> put jwt-signing-key <value>

Rotation

Putting a new value creates a new version. Later resolutions get the new one.

A workflow run pins the version it first resolved, so a long run keeps signing with one key even if the secret rotates while it is parked.

Example

local signing = secret "jwt-signing-key"

local function tokens()
    return Jwt.new("HS256", signing)
end

on "fetch" (function(request)
    local token = tokens():encode({ sub = "ada", exp = os.time() + 3600 })
    return { body = token }
end)

Console

The secrets view shows names, versions, who declared them, and which scripts reach them. Values are never shown after they are set.

Gotchas

  • Build the signer inside the handler. The top level runs the declaration pass, where runtime surfaces are inert.
  • A secret that is not set fails every request of the script with Secret 'name' is not set for this project., not the code path that uses it, because it resolves at declaration.
  • A rotation does not reach a parked workflow run. That is the point: the run finishes on the key it started with.
  • There is no way to read a value back. Losing it means putting a new one and rotating whatever trusted the old.

Related