Secrets

Browserbase Secrets stores credentials that your Functions need at runtime. Create a secret once, attach it to a Function, and read the value from context.secrets when an invocation starts. Use Secrets for values such as third-party API tokens, service credentials, and other sensitive configuration that should not live in Function code.

​

How secrets work

1. The Browse CLI gets your project’s public key and encrypts the value on your machine.
2. Browserbase stores the encrypted value and returns a secret ID.
3. You attach the secret ID to a Function.
4. Browserbase loads the attached value into context.secrets when an invocation starts.

A Function can read only the secrets attached to it. Function secrets are not environment variables and are not available through process.env in a deployed invocation.

​

Access model

Secrets and Functions must belong to the same Browserbase project. Browserbase resolves the project from the API key used for each command or SDK request.

​

Secrets and invocation parameters

Use a secret for a sensitive value that a Function needs across invocations. Use invocation parameters for non-sensitive input that changes from one invocation to the next. For local development, use a local environment variable as a fallback. Function attachments apply only to deployed invocations.

​

Next steps