Environment Variables in Snippets

Georges Duverger

I created a snippet for one of my endpoints. In it, I use an environment variable. That variable got added to the new workspace that installed the snippet — that's good. What I didn't expect to happen is that the *value* of that environment variable got copied as well. Is that the expected behavior or a bug?

Chris Coleman

Hi, Georges. The values contained inside an endpoint will be transferred with the snippet. This is expected behavior.

Ray Deck

 I don't see where this behavior is documented - how could Georges expect it? User-generated environment variables are almost always secrets, so this could have some side-effects. Perhaps if this is to be the way the system works it'd be worth adding a note/warning on this to the docs? 

Michael Udinski

 at the time of Snippet creation you should be able to delete the values contained in any included environment variables. If you do not, then the values will be included in the Snippet

Michael Udinski

 I hear your point, however, Environment Variables are not exclusively used (although often times are) for keys/secrets so that needs to be considered

Georges Duverger

 I saw the option to remove records from a table but not the option to delete the values of environment variables. Could you point out to me how I would do that?

Georges Duverger

 That's fair. It's definitely a product decision. Just for the record, we were pretty surprised to observe that behavior but it might be just us. 🤷‍♂️

Georges Duverger

  Thanks for your responses. I'd agree with Ray's suggestion to add a warning in the doc. We came pretty close to sharing private API keys with one of our users. 😬

Michael Udinski

 - here's an example:[CleanShot 2022-06-10 at 14.36.54.gif]

Michael Udinski

  - We have warnings in a couple different places but maybe they should be more in your face like a pop out and confirmation
[CleanShot 2022-06-10 at 14.37.40.png][CleanShot 2022-06-10 at 14.37.23.png]

Sean Montgomery

There is definitely a warning in red, but maybe we should turn that into a checkbox confirmation since it is easy to skim over things.

Chris Coleman

  Good call. Added a note about this in the docs!

Georges Duverger

   Thanks a lot for your responses. I might be doing something wrong but I'm not seeing the Environment Variables section in the Snippet creation drawer (see attached screenshot). 🤔[Screen Shot 2022-06-13 at 4.31.12 PM.png]

Michael Udinski

 they would only show up if they are used in an API endpoint included in the snippet. Does the one endpoint in that screenshot use an environment variable?

Georges Duverger

 Yes, it does. Though, not in a very realistic way. I just returned it in the Response for testing purposes (see attached screenshot).[Screen Shot 2022-06-13 at 4.40.35 PM.png]

Michael Udinski

 - got it, maybe not the most realistic but we could add something there. I also noticed in exploring this, if there is no value for your environment variable (and it's used in the function stack 😉) there will be no warning. Currently, it's only when it is holding a value (and in the function stack) that the warning message will show. 

Georges Duverger

 Ah! I see it now when I use it in the Function stack. My bad. Thank you very much for the clarification. 💪