Secret Expansion

Automatic variable reference resolution with ${VAR} syntax.

Redenv supports referencing other secrets using ${VAR_NAME} syntax. References are automatically resolved when secrets are loaded.

Info

For a deep dive into how expansion works, syntax rules, and use cases, see Secret Expansion.

Quick Example#

Secrets in Redenv

BASE_URL=https://api.example.com
AUTH_URL=${BASE_URL}/auth
CALLBACK_URL=${AUTH_URL}/callback

In your code

secrets = redenv.load()

secrets["AUTH_URL"]      # https://api.example.com/auth
secrets["CALLBACK_URL"]  # https://api.example.com/auth/callback

Use .raw to get unexpanded values (useful for debugging):

secrets["AUTH_URL"]      # https://api.example.com/auth
secrets.raw["AUTH_URL"]  # ${BASE_URL}/auth

DB_HOST=localhost
DB_PORT=5432
DB_USER=admin
DB_PASS=secret
DATABASE_URL=postgresql://${DB_USER}:${DB_PASS}@${DB_HOST}:${DB_PORT}/myapp

# Development
API_HOST=localhost:3000

# Production
API_HOST=api.myapp.com

# Both use
API_URL=https://${API_HOST}/v1

Use \${ for literal dollar-brace:

MESSAGE=Use \${VAR} syntax for variables

secrets["MESSAGE"]  # Use ${VAR} syntax for variables

Missing references are left unexpanded (no error thrown):

# If UNDEFINED_VAR doesn't exist:
secrets["SOME_URL"]  # ${UNDEFINED_VAR}/path

Tip

Use secrets.require() to validate base secrets exist before relying on expanded values.