Backbone Secrets

Encrypted at rest with AES-256-GCM. Declare which secrets a function may read with the secrets= keyword on its @atomic directive, then read them with the SDK:

// @atomic http=post:charge auth=apikey secrets=STRIPE_KEY
key, _ := drift.Backbone.Secret.Get("STRIPE_KEY")

Before the subprocess starts, the runner fetches each declared secret and injects it twice: as the environment variable DRIFT_SECRET_<NAME> with the name uppercased, which is what Secret.Get reads, and inline in the request envelope's secrets field, readable as req.secrets in all six languages.

drift backbone secret set    STRIPE_KEY=sk-123abc
drift backbone secret get    STRIPE_KEY
drift backbone secret list
drift backbone secret delete STRIPE_KEY

You can also set secrets declaratively in the Driftfile (literal values or $ENV references resolved at deploy).

At runtime a function reads secrets and does not create them. The subprocess starts with a cleared environment and never holds the slice's internal token, so a secret the function did not declare cannot be fetched over HTTP, and Secret.Set answers 401. Secrets are provisioned out of band, with drift backbone secret set or in the Driftfile.

That makes Secrets the right home for a value your app must keep stable across cold starts, like a signing key: generate it out of band, set it once, declare it, then read it, validating the length so a missing or unreadable secret fails loudly instead of signing with garbage.

# provision once, out of band, never from inside a function
drift backbone secret set SIGNING_KEY=$(openssl rand -hex 32)

// @atomic http=post:sign secrets=SIGNING_KEY
func signingKey() ([]byte, error) {
    hex, err := drift.Backbone.Secret.Get("SIGNING_KEY")   // from DRIFT_SECRET_SIGNING_KEY
    if err != nil || len(hex) != 64 {
        return nil, fmt.Errorf("SIGNING_KEY missing or malformed")
    }
    return decodeHex(hex)
}

If all you need is a token for user sessions, you don't need a key of your own at all: the platform's JWT signing key is managed for you.