What's the right way for secrets handling at runtime ?

[arkhaiel]

Hello again,

I'm trying to interact with mistral API, and it's the first time I need to use a secret at runtime on the CF Workers so I'm not sure I do the right thing.

The problem is when I hit the api route I have a 401 error in production, but it works fine in local dev. So I guess I missed something, but I can't figure out what.

My understanding of the situation is I need to replace .env file with variables defined in the cloudflare dashboard ?

Thanks for you help, I've tried different things, but each time I need to build and deploy and I ran out of ideas so I'm kinda stuck.

edit : if I deploy with pnpm build and npx nuxthub deploy --no-build it works, maybe because the API key is copied from my .env file ?
edit2 : ok, so I defined the secret in github environment variables, like I did for nuxt ui pro licence key, and it works. I'm confused because in my mind there was two kind of variables, those for the build defined in github and those for the runtime defined in cloudflare... It works now but I'm not sure I understand why !

Here's my route API :

export default defineEventHandler(async (event) => {
  setResponseHeader(event, 'Content-Type', 'text/html')
  setResponseHeader(event, 'Cache-Control', 'no-cache')
  setResponseHeader(event, 'Transfer-Encoding', 'chunked')

  const body = await readBody(event)
  console.log('Body:', body)
  const config = useRuntimeConfig()

  const response = await $fetch('https://api.mistral.ai/v1/chat/completions', {
    headers: {
      Authorization: `Bearer ${config.mistralAPI}`,
      'Content-Type': 'application/json',
    },
    method: 'POST',
    responseType: 'stream',
    body: JSON.stringify({
      model: 'mistral-tiny',
      stream: true,
      messages: [{ role: 'user', content: body.query }],
    }),
  })

  return response
})

In nuxt.config.ts:

  runtimeConfig: {
    mistralAPI: process.env.MISTRAL_API_KEY,
    session: {
      cookie: {
        domain: '.nsi.rocks',
      },
    },
  },

In Cloudflare dashboard :

[InvixGG]

Hi @arkhaiel ,

I'm currently in the same struggle.

1. Did you end up deploying via the command instead of letting CI/CD handle it via GitHub actions?

2. Did you define the variables in Cloudflare directly instead of the NuxtHub environment?

3. Did you define all your variables in the runtimeConfig and then everywhere you need the key you used the config to retrieve them?

[arkhaiel]

Hi @InvixGG ! What worked for me if you want to deploy with GH Actions :

• I define the secret in Repository > Settings > under Secrets and Variables > Actions
• In my .github/workflows/nuxthub.yml file :

      - name: Build application
        run: pnpm build
        env: 
          NUXT_UI_PRO_LICENSE: ${{ secrets.NUXT_UI_PRO_LICENSE }}
          MISTRAL_API_KEY: ${{ secrets.MISTRAL_API_KEY }}

• In nuxt.config.ts :

  runtimeConfig: {
    mistralAPI: process.env.MISTRAL_API_KEY,
  },

• In my API route :

  const config = useRuntimeConfig()
// ....
      Authorization: `Bearer ${config.mistralAPI}`,

There's probably a more simple solution, but this one works !

[InvixGG]

There's probably a more simple solution, but this one works !

Thank you so much man! Will try this out.