API Plugin for Write Only Config Vars (Beta)

Warning

This feature is currently in beta and there are a number of known issues that will break if used, please review the list of known issues before using this feature in a production environment. This list will be updated as issues are resolved.

• Usage
• Commands
• Development
• Known Issues

Usage

# Note: The write-only-config-vars feature must be enabled
# on your user account in order to use this feature.
#
# Via NPM
% heroku plugins:install write-only-config-vars
heroku: linking plugin write-only-config-vars... done
# Via repo
% heroku plugins:install heroku/write-only-config-vars
heroku: linking plugin write-only-config-vars... done
% write-only-config-vars COMMAND
running command...
% write-only-config-vars (--version)
write-only-config-vars/0.0.0 darwin-x64 node-v20.3.0
% write-only-config-vars --help [COMMAND]
USAGE
  % write-only-config-vars COMMAND
...

Commands

• write-only-config-vars:set CONFIG_VAR_NAME
• write-only-config-vars:set CONFIG_VAR_NAME VALUE

write-only-config-vars:set CONFIG_VAR_NAME

Enable the write only flag for an existing config var

USAGE
  % write-only-config-vars:set CONFIG_VAR_NAME -a <app_name>

ARGUMENTS
  CONFIG_VAR_NAME  The name of the config var

FLAGS
  -a, --app=<app_name>  (required) app to run command against 

DESCRIPTION
  Enable the write-only flag for a config var on your app.

EXAMPLES
  % heroku write-only-config:set DATABASE_URL -a myapp
  DATABASE_URL has been permanently masked.

write-only-config-vars:set CONFIG_VAR_NAME VALUE

Create a new config var or overwrite the value of an existing config var and enable the write only flag

USAGE
  % write-only-config-vars:set CONFIG_VAR_NAME VALUE -a <app_name>

ARGUMENTS
  CONFIG_VAR_NAME  The name of the config var
  VALUE  A value to set the config var to

FLAGS
  -a, --app=<app_name>  (required) app to run command against 

DESCRIPTION
  Enable the write-only flag for a config var on your app.

EXAMPLES
  % heroku write-only-config:set DATABASE_URL postgres://heroku/otherdb -a myapp
  DATABASE_URL has been updated and masked.

Development

You can clone the repo and link a local copy of the plugin in order to develop locally.

# Install dependencies
npm install -g shx yarn
# Clone the repo
% gh repo clone heroku/write-only-config-vars && cd write-only-config-vars
Cloning into 'write-only-config-vars'...
# Install dependencies and build the plugin
% yarn install && yarn build
yarn install v1.22.19
...
yarn run v1.22.19
...
% heroku plugins:link
heroku: linking plugin write-only-config-vars... done
...

Known Issues

Please review this list of known issues before using this feature.

Fetching Config Vars

Anything that calls /apps/<app_name>/config-vars or addons/<addon>/config will need to get the string from the one off dyno instead.

% heroku run -a <app_name> "env | grep DATABASE_URL"
Running env | grep DATABASE_URL on ⬢ <app_name>... up, run.1403 (Eco)
DATABASE_URL=<config_var_value>

The user running this dyno will need to have one of the following permissions: Owner, Collab, Deploy, Operate

Note: Private spaces will need to add an SSH key to their account.

PG commands

Some commands like: GET /postgres/v0/databases/postgresql-globular-01550/credentials/default do not yet support masking. Others, like pg:info and pg:psql will not work.

Note: We are working on enabling this feature for database credentials, however it should not be used to mask database credentials at this time.

Third party add-ons

If the app owner decides to make the config var write-only for the add-on then it will break if the add-on makes a GET request to /addons/:addon/config to fetch the vars.

Note: Not All third party add-ons make GET request