# Load Secrets from env.yml

**URL:** <https://discourse.sst.dev/t/load-secrets-from-env-yml/171>\
**Category:** Chapter Comments\
**Created:** [May 9, 2018, 11:18pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171 "2018-05-09T23:18:07Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [May 9, 2018, 11:18pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/1 "2018-05-09T23:18:07Z")

</div>

Link to chapter - [https://serverless-stack.com/chapters/load-secrets-from-env-yml.html](https://serverless-stack.com/chapters/load-secrets-from-env-yml.html)

---

<div class="post-metadata">

**Author:** ![James](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@James](https://discourse.sst.dev/u/James)\
**Post date:** [September 13, 2018, 11:19pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/2 "2018-09-13T23:19:56Z")

</div>

I am getting this error.

```auto
{
    "statusCode": 500,
    "headers": {
        "Access-Control-Allow-Origin": "*",
        "Access-Control-Allow-Credentials": true
    },
    "body": "{\"message\":\"You did not provide an API key, though you did set your Authorization header to \\\"null\\\". Using Bearer auth, your Authorization header should look something like 'Authorization: Bearer YOUR_SECRET_KEY'. See https://stripe.com/docs/api#authentication for details, or we can help at https://support.stripe.com/.\"}"

```

If I hard code const stripe = stripePackage(“sk\_test\_\*\*\*\*\*\*” ); into billing.js it works but if I follow instructions to access it through env.yml I get the above error.

Any idea what is going wrong?

---

<div class="post-metadata">

**Author:** ![James](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@James](https://discourse.sst.dev/u/James)\
**Post date:** [October 15, 2018, 6:03pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/3 "2018-10-15T18:03:09Z")

</div>

The problem is mostly solved. I found that if I put the environmental variables in the billing function in serverless.yml (as per [https://serverless-stack.com/chapters/serverless-environment-variables.html](https://serverless-stack.com/chapters/serverless-environment-variables.html)), I can access them. But anywhere else the variable will be passed as undefined.

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [October 18, 2018, 7:03pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/4 "2018-10-18T19:03:50Z")

</div>

Hmm can you make sure that the `env.yml` is correctly placed in the same folder as your `serverless.yml`?

---

<div class="post-metadata">

**Author:** ![davincios](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/davincios/32/844_2.png) [@davincios](https://discourse.sst.dev/u/davincios)\
**Post date:** [November 19, 2018, 1:33am UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/5 "2018-11-19T01:33:44Z")

</div>

I have the same issue.

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [November 19, 2018, 1:54am UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/6 "2018-11-19T01:54:47Z")

</div>

Can you post some details on the issue you are having?

---

<div class="post-metadata">

**Author:** ![davincios](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/davincios/32/844_2.png) [@davincios](https://discourse.sst.dev/u/davincios)\
**Post date:** [November 19, 2018, 1:52pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/7 "2018-11-19T13:52:55Z")

</div>

It seems that it is not possible for us to access the secret keys from the env.yml when using them in the billing.js file.

Instead it returns ‘undefined’:

```auto
process.env.stripeSecretKey

```

As a work around we hard code them in the API request and it works.

/// Hardcoding the secret key  
const secretAPIKey = “sk\_test\_I0kUXXXXXXXXXXXX”

export async function main(event, context) {  
const { storage, source } = JSON.parse(event.body);  
const amount = calculateCost(storage);  
const description = “Scratch charge”;

```
// Using the hard coded key instead of loading it from the environment variables
const stripe = stripePackage(secretAPIKey);
```

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [November 25, 2018, 6:54pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/8 "2018-11-25T18:54:16Z")

</div>

Are you running this locally? Cos it works fine in the sample repo.

> <https://github.com/AnomalyInnovations/serverless-stack-demo-api/blob/master/billing.js#L11>

---

<div class="post-metadata">

**Author:** ![VividWombat](https://avatars.discourse-cdn.com/v4/letter/v/c37758/32.png) [@VividWombat](https://discourse.sst.dev/u/VividWombat)\
**Post date:** [December 31, 2018, 2:23pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/9 "2018-12-31T14:23:24Z")

</div>

am following the tutorial exactly as written, and I also get this 500 error

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [January 6, 2019, 3:27am UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/10 "2019-01-06T03:27:53Z")

</div>

For 500 errors you should be able to log them. Whats the error you are seeing?

---

<div class="post-metadata">

**Author:** ![hounded](https://avatars.discourse-cdn.com/v4/letter/h/5daacb/32.png) [@hounded](https://discourse.sst.dev/u/hounded)\
**Post date:** [September 21, 2019, 10:01pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/11 "2019-09-21T22:01:39Z")

</div>

Why not just put you stripe key in SSM as a secureString, and pull it out in the lambda when you need it?

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [September 28, 2019, 6:29pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/12 "2019-09-28T18:29:19Z")

</div>

You could. But this chapter is to introduce the idea of Lambda environment variables. We’ll have a chapter on SSM coming out soon.

---

<div class="post-metadata">

**Author:** ![gommster](https://avatars.discourse-cdn.com/v4/letter/g/4491bb/32.png) [@gommster](https://discourse.sst.dev/u/gommster)\
**Post date:** [November 6, 2019, 2:18am UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/13 "2019-11-06T02:18:46Z")

</div>

I replaced “process.env.stripeSecretKey” with “process.env.STRIPE\_SECRET\_KEY” so that billing.js retrieves the variable for itself. I guess the serverless.yml is supposed to be tying things together but it isn’t doing that properly. This way, the variables are still stored locally, so idk why this isn’t done like this in the firs place. Can anyone explain why we the serverless.yml is supposed to load the environment variable, and how calling billing.js is supposed to be retrieving the environment variables from serverless.yml? Did I miss something that is supposed to tie the billing.js to the serverless.yml?

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [November 16, 2019, 6:12pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/14 "2019-11-16T18:12:06Z")

</div>

Well so the latest version of this chapter ([https://serverless-stack.com/chapters/load-secrets-from-env.html](https://serverless-stack.com/chapters/load-secrets-from-env.html)) uses the dotenv plugin ([https://github.com/colynb/serverless-dotenv-plugin](https://github.com/colynb/serverless-dotenv-plugin)) to take everything in the `.env` file and add it as an environment variable in your Lambda function. Hope that makes sense.

---

<div class="post-metadata">

**Author:** ![boxabirds](https://avatars.discourse-cdn.com/v4/letter/b/c57346/32.png) [@boxabirds](https://discourse.sst.dev/u/boxabirds)\
**Post date:** [December 13, 2019, 12:17pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/15 "2019-12-13T12:17:40Z")

</div>

I just tried it and it works out of the box, particularly when I spell `stripeSecretKey` correctly 😃

---

<div class="post-metadata">

**Author:** ![kevin.portlock](https://avatars.discourse-cdn.com/v4/letter/k/e5b9ba/32.png) [@kevin.portlock](https://discourse.sst.dev/u/kevin.portlock)\
**Post date:** [February 23, 2020, 9:04am UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/16 "2020-02-23T09:04:34Z")

</div>

Make sure yourt indentation is correct in your serverless.yml file.  
environment is indented under provider.

I got stuck on that one for a little while.

---

<div class="post-metadata">

**Author:** ![AntonioUlatina](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@AntonioUlatina](https://discourse.sst.dev/u/AntonioUlatina)\
**Post date:** [May 11, 2020, 11:45pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/17 "2020-05-11T23:45:24Z")

</div>

When I tried following all of the tutorial instructions I got an undefined secret key

![image](https://canada1.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/b3d2b180241fb6483076fdcc486f35631b253dbb.png)

---

<div class="post-metadata">

**Author:** ![AntonioUlatina](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@AntonioUlatina](https://discourse.sst.dev/u/AntonioUlatina)\
**Post date:** [May 11, 2020, 11:45pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/18 "2020-05-11T23:45:56Z")

</div>

![image](https://canada1.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/652b23404ba1b4048d15f26be51b6f9e69b7de55.png)

But when I used a @gommster’s suggestion, it just worked

---

<div class="post-metadata">

**Author:** ![AntonioUlatina](https://avatars.discourse-cdn.com/v4/letter/a/4491bb/32.png) [@AntonioUlatina](https://discourse.sst.dev/u/AntonioUlatina)\
**Post date:** [May 11, 2020, 11:48pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/19 "2020-05-11T23:48:22Z")

</div>

![image](https://canada1.discourse-cdn.com/flex032/uploads/serverless_stack/original/1X/71de1131ce767bb9ec7b988b759260e88c0034f2.png)

@jayair My original intention was to make a single post but the page forced me to use 1 image per post

---

<div class="post-metadata">

**Author:** ![jayair](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.sst.dev/jayair/32/9_2.png) [@jayair](https://discourse.sst.dev/u/jayair)\
**Post date:** [May 17, 2020, 6:35pm UTC](https://discourse.sst.dev/t/load-secrets-from-env-yml/171/20 "2020-05-17T18:35:14Z")

</div>

No worries, glad you figured it out.