Skip to main content

Secrets

Reboot provides support for storing and reading secret values that your application needs at runtime (such as API keys, passwords, etc).

Secrets are environment variables of your choice. For example, a Mailgun API key might be stored as MAILGUN_API_KEY.

Reading secrets​

To read a secret in your Reboot application, use your language's standard environment variable API:

import os

api_key = os.environ["MAILGUN_API_KEY"]

Setting secrets​

Setting secrets for local development​

When running locally with rbt dev run, you may set any environment variable (including secrets) with the --env flag:

rbt dev run --env=MAILGUN_API_KEY=my-api-key

You may permanently set a secret for rbt dev run by including that flag in your .rbtrc:

# If your dev-time secret is NOT sensitive, you may add it to your 
# `.rbtrc` to have it for every `rbt dev run`.
dev run --env=MAILGUN_API_KEY=dummy
Secrets in .rbtrc

Do NOT add sensitive secrets to your .rbtrc! Since .rbtrc is checked into your version control, you risk leaking these secrets. Only use secrets in .rbtrc when the value used during rbt dev run is not, in fact, secret!

If your development secrets are sensitive, you don't want them in terminal history or version control. To achieve this, simply set the environment variable in your terminal in any way you like:

export MAILGUN_API_KEY=$(pass show -c mailgun/api-key)
rbt dev run --application=backend/src/main.py

Setting secrets in Reboot Cloud​

Use the rbt cloud secret CLI commands to manage secrets for a deployed application. Like all rbt cloud commands, they authenticate with an API key (see Create an API key):

# Set secrets by name, reading values from your environment.
# This avoids exposing secret values in shell history or
# process listings.
export MAILGUN_API_KEY=$(pass show -c mailgun/api-key)
rbt cloud secret set \
    --organization="ACME" \
    --application-name=my-app \
    MAILGUN_API_KEY 

# Or pass values inline (but note: KEY=VALUE on the command line may be
# visible in shell history).
rbt cloud secret set \
    --organization="ACME" \
    --application-name=my-app \
    MAILGUN_API_KEY=my-api-key

# List secret names (values are never shown).
rbt cloud secret list \
    --organization="ACME" \
    --application-name=my-app

# Delete secrets.
rbt cloud secret delete \
    --organization="ACME" \
    --application-name=my-app \
    MAILGUN_API_KEY

Secret names must be uppercase environment variable names: letters, digits, and underscores; not starting with a digit. They must not start with REBOOT_ or RBT_ -- those names are reserved by Reboot.

Setting or deleting secrets on a running application triggers an automatic restart so the new values take effect.

Testing with secrets​

In tests, set the environment variable before starting the Reboot test harness:

import os

os.environ["MAILGUN_API_KEY"] = "test-api-key"