Script variables

Script variables are key/value pairs available to scripts as ctx.env. Use them for secrets such as API tokens: values are encrypted at rest with TOKEN_ENCRYPTION_KEY and never returned by the API. On an instance without that key they’re stored unencrypted, and the first boot with one encrypts them.

TypeScript

const TOKEN = "hv_..."; // your API key
const headers = { Authorization: `Bearer ${TOKEN}` };

JavaScript

const TOKEN = "hv_..."; // your API key
const headers = { Authorization: `Bearer ${TOKEN}` };

Rust

let token = "hv_..."; // your API key

Go

const token = "hv_..." // your API key

cURL

Bearer

# All examples assume $TOKEN is an API key (hv_...)AUTH="Authorization: Bearer $TOKEN"

List script variables

GET /admin/script-variables

Requires script-variables:read. Returns the variables ordered by key. Values are never returned. preview is always ****, whatever the value. unreadable is true for a value this instance’s TOKEN_ENCRYPTION_KEY can’t decrypt, usually because the key changed; scripts see such a variable as unset, and setting it again replaces it.

Response: 200 OK

[
  {
    "key": "API_TOKEN",
    "preview": "****",
    "unreadable": false,
    "created_at": "2026-03-01T00:00:00Z",
    "updated_at": "2026-03-01T00:00:00Z"
  }
]

Upsert a script variable

POST /admin/script-variables

Requires script-variables:create. Sets value for key, creating the variable or replacing its value. Both fields are required strings.

TypeScript

const response = await fetch("http://127.0.0.1:3000/admin/script-variables", {
  method: "POST",
  headers: {
    ...headers,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ key: "ALGOLIA_API_KEY", value: "..." }),
});

JavaScript

const response = await fetch("http://127.0.0.1:3000/admin/script-variables", {
  method: "POST",
  headers: {
    ...headers,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ key: "ALGOLIA_API_KEY", value: "..." }),
});

Rust

let client = reqwest::Client::new();
let response = client
    .post("http://127.0.0.1:3000/admin/script-variables")
    .bearer_auth(token)
    .json(&serde_json::json!({ "key": "ALGOLIA_API_KEY", "value": "..." }))
    .send()
    .await?;

Go

body := bytes.NewBufferString(`{ "key": "ALGOLIA_API_KEY", "value": "..." }`)
req, _ := http.NewRequest("POST", "http://127.0.0.1:3000/admin/script-variables", body)
req.Header.Set("Authorization", "Bearer "+token)
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil {
  log.Fatal(err)
}
defer resp.Body.Close()

cURL

curl

curl -X POST http://127.0.0.1:3000/admin/script-variables \  -H "$AUTH" \  -H "Content-Type: application/json" \  -d '{ "key": "ALGOLIA_API_KEY", "value": "..." }'

Response: 204 No Content

Delete a script variable

DELETE /admin/script-variables/{key}

Requires script-variables:delete.

Response: 204 No Content. Returns 404 Not Found for an unknown key.