Use secrets in Functions

A Function can read only the secrets that you attach to it. When an invocation starts, Browserbase loads the attached values into context.secrets. Before you begin, create a secret and create a Functions project with the Functions quickstart. The SDK examples use @browserbasehq/sdk for Node.js and browserbase for Python.

Attach and use a secret

Read the secret in the handler

Read the value from context.secrets with the name that you chose when you created the secret:

Node.js

import { defineFn } from "@browserbasehq/sdk-functions";

defineFn("call-service", async (context) => {
  const secrets = context.secrets as Record<string, string>;
  const serviceToken = secrets.SERVICE_TOKEN;

  if (!serviceToken) {
    throw new Error("Attach SERVICE_TOKEN before you invoke this Function");
  }

  const response = await fetch("https://api.example.com/data", {
    headers: {
      Authorization: `Bearer ${serviceToken}`,
    },
  });

  return { status: response.status };
});

Function secrets are not environment variables. Read attached secrets from context.secrets, not process.env.

Publish the Function

Publish the entrypoint:

browse functions publish index.ts

The command prints the Function ID. Save it for the next step.

Attach the secret

Pass the Function ID and secret ID:

Browse CLI
Node.js
Python

browse functions secrets attach <function-id> <secret-id>
browse functions secrets list <function-id>

Node.js

import { Browserbase } from "@browserbasehq/sdk";

const bb = new Browserbase({
  apiKey: process.env.BROWSERBASE_API_KEY!,
});

const functionId = "<function-id>";
const secretId = "<secret-id>";

await bb.functions.secrets.attach(functionId, { secretId });

const attachments = await bb.functions.secrets.list(functionId);
console.log(attachments.data);

Python

import os
from browserbase import Browserbase

bb = Browserbase(api_key=os.environ["BROWSERBASE_API_KEY"])

function_id = "<function-id>"
secret_id = "<secret-id>"

bb.functions.secrets.attach(function_id, secret_id=secret_id)

attachments = bb.functions.secrets.list(function_id)
print(attachments.data)

The Function and secret must belong to the same Browserbase project.The list contains metadata only. It does not contain secret values.

Invoke the Function

Invoke the deployed Function:

browse functions invoke <function-id>

Browserbase loads the attached values when the invocation starts. The handler reads them from context.secrets.

Test during local development

Function attachments apply only to deployed invocations. The local development server does not load them.Use a local environment variable as a development fallback:

Node.js

const attachedSecrets = context.secrets as
  | Record<string, string>
  | undefined;
const serviceToken =
  attachedSecrets?.SERVICE_TOKEN ?? process.env.SERVICE_TOKEN;

Don’t commit local secret values or .env files.

Update an attached secret

Update the secret by ID:

browse cloud secrets update <secret-id>

The update keeps the same secret ID and Function attachments. New invocations use the new value.

Detach a secret

Remove the Function’s access without deleting the secret:

Browse CLI
Node.js
Python

browse functions secrets detach <function-id> <secret-id>
browse functions secrets list <function-id>

Node.js

import { Browserbase } from "@browserbasehq/sdk";

const bb = new Browserbase({
  apiKey: process.env.BROWSERBASE_API_KEY!,
});

const functionId = "<function-id>";
const secretId = "<secret-id>";

await bb.functions.secrets.detach(functionId, secretId);

const attachments = await bb.functions.secrets.list(functionId);
console.log(attachments.data);

Python

import os
from browserbase import Browserbase

bb = Browserbase(api_key=os.environ["BROWSERBASE_API_KEY"])

function_id = "<function-id>"
secret_id = "<secret-id>"

bb.functions.secrets.detach(secret_id=secret_id, id=function_id)

attachments = bb.functions.secrets.list(function_id)
print(attachments.data)

Later invocations no longer receive the detached secret.

Troubleshooting

Problem	Check
Attach returns `404`	Confirm that the Function and secret IDs belong to the API key’s project.
`context.secrets` does not contain the name	List the Function attachments, then compare the secret name with the code.

Welcome

Platform

Use cases

Optimization

Account

Attach and use a secret

Update an attached secret

Detach a secret

Troubleshooting

Next steps

Manage secrets

Invoke a Function

​Attach and use a secret

​Update an attached secret

​Detach a secret

​Troubleshooting

​Next steps

Manage secrets

Invoke a Function

Attach and use a secret

Update an attached secret

Detach a secret

Troubleshooting

Next steps