Deno Deploy
One VARS_KEY, runtime decrypt on Deno Deploy.
Setup
vars gen config.vars --platform serverlessDeno has built-in Web Crypto, so the generated module runs without any polyfills.
Usage
import { getVars } from '#vars'
Deno.serve(async () => {
const vars = await getVars(Deno.env.toObject())
return new Response(`hello from ${vars.APP_NAME}`)
})Secrets
Deno Deploy → Project → Settings → Environment Variables:
VARS_KEY— the output ofvars key exportVARS_ENV— the env name, e.g.prod
No per-secret entries.
Local dev
{
"scripts": {
"dev": "vars run --env dev -- deno run --allow-net --allow-env main.ts"
}
}vars run sets VARS_KEY and VARS_ENV in process.env; Deno picks them up via Deno.env.toObject().