Envlet on Netlify

Functions and edge functions read ENVLET_TOKEN from Netlify and load the rest from Envlet.

ENVLET_TOKENset with netlify

Set up

Three steps. The host keeps one secret and everything else arrives at boot.

01
Create a token
Add Netlify under Access and create a token for the environment it deploys.
ci/netlifyci
Its own token, separate from your login.
token
envlet_•••••••• shown once
opens
one project, one environment
expires
always
02
Set one secret
netlify env:set with a context per deploy context, each with its own Envlet token.
Set the token
netlify env:set ENVLET_TOKEN envlet_... --context production

Call load() or inject() at the top of the function module.

Load in a function

import { load } from "@envlet/sdk";

export default async () => {
  const values = await load();
  return new Response(values.APP_NAME);
};

One secret in Netlify. Rotate everything else in Envlet without touching the host.

Netlify / production / environment variables1 secret

ENVLET_TOKEN	envlet_••••••••	the only secret the host keeps
DATABASE_URL	••••••••	moved to Envlet
STRIPE_KEY	••••••••	moved to Envlet
SENTRY_DSN	••••••••	moved to Envlet

Will my app start if Envlet is down?

No. It retries for a few seconds, then fails so you notice. It never starts with half an environment.

Do I still need Netlify's own secret store?

Only for ENVLET_TOKEN. Everything else lives in Envlet, so you rotate in one place.

One command. The right values for whoever runs it.