Provider Import

How It Works

1. Connect — provide your provider API key and service/project identifier
2. Preview — secr fetches all variables and shows them in a table
3. Select — choose which variables to import (all selected by default)
4. Import — selected variables are encrypted and stored as secr secrets

Supported Providers

CLI Usage

Use secr import to import from a provider. Requires a linked project (.secr.json).

secr import --from <provider> --key <api-key> --service-id <id>

secr import --from render \
  --key rnd_xxxxxxxxxxxx \
  --service-id srv-abc123def456

secr import --from vercel \
  --key tok_xxxxxxxxxxxx \
  --service-id prj-abc123def456

secr import --from heroku \
  --key h_xxxxxxxxxxxx \
  --service-id my-app-name

secr import --from netlify \
  --key nfp_xxxxxxxxxxxx \
  --service-id abc123-def456-ghi789

secr import --from supabase \
  --key sbp_xxxxxxxxxxxx \
  --service-id abcdefghijklmnop

secr import --from railway \
  --key rw_xxxxxxxxxxxx \
  --service-id project-uuid \
  --railway-env env-uuid \
  --railway-service service-uuid

The CLI shows a preview table before importing. Use --all to skip the confirmation prompt (useful for CI scripts).

Dashboard Usage

1. Navigate to your project's environment page
2. Click “Import from Provider”
3. Select your provider from the grid
4. Enter your API key and service/project identifier
5. Review the variable list — check or uncheck individual variables
6. Click “Import”

Variables that the provider marks as sensitive or unreadable are shown but cannot be imported (they have no value). These are typically secrets that the provider encrypts and never exposes via API.

API Endpoints

Two endpoints power the import flow. Both require authentication and a verified email.

Preview Request Body

{
  "config": {
    "provider": "heroku",
    "apiKey": "your-api-key",
    "appName": "my-app"
  },
  "orgSlug": "my-org",
  "projectSlug": "my-project",
  "envSlug": "development"
}

Preview Response

{
  "provider": "heroku",
  "vars": [
    { "key": "DATABASE_URL", "value": "postgres://...", "sensitive": false },
    { "key": "SECRET_KEY", "value": "", "sensitive": true }
  ],
  "count": 2,
  "skipped": 1
}

Execute Request Body

{
  "config": {
    "provider": "heroku",
    "apiKey": "your-api-key",
    "appName": "my-app"
  },
  "orgSlug": "my-org",
  "projectSlug": "my-project",
  "envSlug": "development",
  "selectedKeys": ["DATABASE_URL"]
}

Execute Response

{
  "created": 1,
  "updated": 0,
  "total": 1
}

Provider Config Shapes

The config object varies by provider. Each uses a discriminated union on the provider field.

// Render
{ "provider": "render", "apiKey": "...", "serviceId": "srv-..." }

// Vercel
{ "provider": "vercel", "apiKey": "...", "projectId": "prj-..." }

// Heroku
{ "provider": "heroku", "apiKey": "...", "appName": "my-app" }

// Netlify
{ "provider": "netlify", "apiKey": "...", "siteId": "..." }

// Supabase
{ "provider": "supabase", "apiKey": "...", "projectRef": "..." }

// Railway
{ "provider": "railway", "apiKey": "...", "projectId": "...",
  "environmentId": "...",   // optional
  "serviceId": "..."        // optional
}

Sensitive Variables

Some providers restrict access to certain variable values:

• Vercel — variables of type sensitive return empty values
• Railway — sealed variables return *** instead of the actual value

These variables appear in the preview with a “sensitive” label but cannot be imported since the provider does not expose the plaintext value. You'll need to set those manually.