Gatsby Netlify and secret keys in gatsby-config.js

[perry]

hi there, maybe one of the posts below contains information that is pertinent for you:

[Support Guide] Using environment variables on Netlify correctly

Last reviewed: August 2023 The preferred way to use environment variables in Netlify is to set them in our environment - be that in the Environment Variables settings UI (on the site’s “Build & Deploy settings” page), or via netlify.toml. You’ll want to choose the right pattern to meet your needs. Setting variables in our UI may be considered a bit more secure, since only people with access to the Netlify admin UI for your site can see them, rather than “anyone who can clone your repo!”. Thes…

[Support Guide] How do I keep my API keys/tokens safe using Netlify Functions?

Last reviewed by Netlify Support on Oct 2023 With Jamstack sites, using API keys/tokens to make API calls to other services is a frequent pattern. In some cases, you may want to hard code the keys in your html, when invoking those API calls - which on a service like Netlify means these keys are now public. Anyone can open their browser dev tools and view them, and of course this can lead to someone abusing this access. In some cases, this is fine. For instance, some types of Firebase and Faun…

Protecting API keys in environment variables

Would be great if you could nominate when creating an environment variable that it should be kept secret. Flagging the variable as a secret could then have the following effects: Filter the build log to mask the secret value if found (most secrets are hex/base64/simple-passwords so unlikely to have special encoding if accidentally emitted) Make the secret write-only in the UI, i.e. users can see that there is a value configured and it’s name but not copy/view what the current value is. Regar…

How to hide stripe secret key using lambda function

I am using a serverless lambda function to run Stripe payments. In my server function i have the following… require(‘dotenv’).config() const stripe = require(‘stripe’)(process.env.STRIPE_SECRET_KEY); i have a .env file with the SK in there, and this works when running on localhost. But it doesnt work when i deploy. I have added the SK in Netlify’s dashboard STRIPE_SECRET_KEY sk_test_opK…sIKZ But it doesnt work for me, what am i doing wrong?

If you still don’t have a starting point after working through those posts, post again here and we will try and find additional resources for you