Secrets and environment
These commands store secrets for your deployed app and keep them in line with your env schema. Secret values are never printed.
On this pageList, add and delete secrets · Sync secrets from a file · Check the env schema
void secret list
void secret list [--project <name>]Lists production secret names for the saved target. Values are never printed. Direct Cloudflare targets read the Worker named in void.config.ts. --project only works for hosted projects.
void secret put
void secret put <name> [--project <name>]
void secret put <name=value> [--project <name>]You can pass the value in three ways. Prefer the prompt or stdin, so the value stays out of shell history:
- inline:
void secret put API_KEY=abcd - prompt (TTY):
void secret put API_KEY(masked input) - stdin:
echo -n "abcd" | void secret put API_KEY
On a direct Cloudflare target, the value is stored as an encrypted Worker secret.
void secret sync
void secret sync <file> [--project <name>]Uploads production server values from a dotenv file kept outside your project. Include only keys declared in env.ts. Leave out local dev credentials and public VITE_* values.
Requires: secret values
The file holds production secrets. Keep it outside the project folder and out of Git.
Now you will sync the file.
void secret sync /secure/path/production.envExample output: a summary of the secrets that were added, changed, or removed. Values are not printed.
Remote secrets that are not in the file are kept. Every entry must be a server key declared in env.ts. Each value must pass validation.
void secret delete
void secret delete <name> [--project <name>]Secret commands use the platform saved in .void/project.json. Hosted projects are found in the same order as deploy: --project, then the env var, then the linked project. Direct Cloudflare targets reject --project and use the pinned root Cloudflare config.
On hosted projects, secret writes and deletes return a retryable conflict while a deploy or rollback runs. Wait for it to finish, then retry. A rejected write leaves the stored secret unchanged.
Env Schema
void env check
void env check [--remote]Without --remote, it checks .env and the shell for local dev. With --remote, it checks client values in the build shell and the remote server-secret names. It exits non-zero if a required key is missing or a readable value is invalid.
void env types
void env typesRegenerates .void/env.d.ts from env.ts. The dev server usually does this on start and on HMR. Run it after a fresh clone, or to refresh stale types outside dev.
Deploy validation
void deploy runs the same checks, including remote secrets. It refuses to upload if a required key is missing. You do not need a separate env check before deploying.
See Environment Variables for the full guide.
