Resolve a secret (AWS Secrets Manager) at runtime.
Local development. Reads process.env.KEY first, so a .env file supplies
the value with no AWS call. On a deployed function it falls through to fetching
the wired secret from Secrets Manager.
Type safety.key is typed as SecretKey: by default any string, but
once you run npm run typegen (which generates a .d.ts augmenting
HostingSecretRegistry from your secret('...') calls) it narrows to your
declared keys — autocomplete, and a typo is a compile error. When you declared a
schema (secret('K', { schema })), the return type is the schema's inferred
output and the value is JSON-parsed at runtime; otherwise it is string.
Resolve a secret (AWS Secrets Manager) at runtime.
Local development. Reads
process.env.KEYfirst, so a.envfile supplies the value with no AWS call. On a deployed function it falls through to fetching the wired secret from Secrets Manager.Type safety.
keyis typed as SecretKey: by default anystring, but once you runnpm run typegen(which generates a.d.tsaugmenting HostingSecretRegistry from yoursecret('...')calls) it narrows to your declared keys — autocomplete, and a typo is a compile error. When you declared aschema(secret('K', { schema })), the return type is the schema's inferred output and the value is JSON-parsed at runtime; otherwise it isstring.