flyt
04 / 16

04 — Secrets

A key the program holds, but can never read.

The program holds a reference. The host writes the key in as the request leaves, and only to its origin.

charge.go
key := os.Getenv("PAYMENTS_KEY")
log.Printf("charging with %s", key)  // in the logs now

req, _ := http.NewRequest("POST", in.CallbackURL, body)
req.Header.Set("Authorization", "Bearer "+key)
http.DefaultClient.Do(req)  // to wherever it points
payments/adapters.flyt
config base_url: Url
config api_key: Secret<to: base_url>

adapter(effects.charge, via: http.request) {
  encode(input, key) {
    http.Request {
      method: Post
url: "{config.base_url}/v1/charges"origin proven
      auth: Bearer { token: config.api_key }
    }
  }
}
  1. In the moduletoken: config.api_key
  2. As it leaves the hostBearer sk_live_••••••