Store API keys as Microfn function secrets

API keys belong in per-function secrets, not source code, JSON input, logs, or agent prompts. Microfn injects configured values at runtime and the @microfn/secret module reads them by name.

Add the secret

Open your function’s Secrets panel and add a key such as WEATHER_API_KEY. Paste the value there and save it. Secret names are case-sensitive.

Read it in the function

import secret from "@microfn/secret";

export async function main(input: { city?: string }) {
  const apiKey = await secret.getRequired("WEATHER_API_KEY");
  const city = input.city || "Tokyo";
  const url = new URL("https://api.example.com/weather");
  url.searchParams.set("city", city);

  const response = await fetch(url, {
    headers: { Authorization: `Bearer ${apiKey}` },
  });

  if (!response.ok) {
    throw new Error(`Weather API returned ${response.status}`);
  }

  return response.json();
}

getRequired stops the execution with a clear error when the value is missing. Use get only when the secret is genuinely optional.

Work with an agent safely

An MCP-connected agent can write code that refers to the secret name. Give it the name, expected use, and API documentation, but add the value through Microfn’s secret UI.

Rotate a key at its provider and update the Microfn secret when it is exposed. Review calling an external API for response handling.