Hi Netlify team,
I believe I’m encountering a Secrets Controller runtime issue on a Git-connected hosted Branch Deploy.
Site: avenour-eft-staging
Plan: Free
Branch: release/first-web
Deploy context: branch-deploy
Framework: Next.js
The affected variables are:
- STRIPE_SECRET_KEY
- STRIPE_PUBLISHABLE_KEY
- STRIPE_WEBHOOK_SECRET
All are configured as secret environment variables and scoped to Builds, Functions, and Runtime for Branch Deploys / Deploy Previews. Production values are intentionally empty.
The problem is that a standard Netlify Function receives STRIPE_SECRET_KEY as a truthy value, but it is not the original Stripe key.
I tested this without exposing or logging any secret values.
Both process.env and Netlify.env.get() report:
- STRIPE_SECRET_KEY exists: true
- starts with sk_test_: false
- starts with sk_live_: false
- STRIPE_PUBLISHABLE_KEY exists: true
- STRIPE_WEBHOOK_SECRET exists: true
- SITE_ID exists: true
The same Branch Deploy’s generated Next.js Lambda consequently reports the Stripe integration as unconfigured.
Importantly, this was reproduced using a Git-connected hosted Branch Deploy, not a CLI alias deploy.
Diagnostic hosted deploy:
Deploy ID: 6a9746250f3e2800083a94bb
Build ID: 6a9746250f3e2800083a94b9
Current cleanup deploy:
Deploy ID: 6a9746919f16b60008624162
Build ID: 6a9746919f16b60008624160
The temporary diagnostic Function has already been removed.
Secret values were never printed, logged, or shared, and I do not want to unflag the Stripe secrets as a workaround.
According to the Secrets Controller documentation, code running on Netlify systems, including serverless Functions, should receive the original unmasked secret values.
Could you please investigate whether Secrets Controller is failing to unmask secret environment variables for Functions on this Branch Deploy?
Thank you.