useRuntimeConfig vs process.env in api routes

[ebon chasm]

Hello, i'm having trouble wrapping my hear around this.

I know that variables in my .env are accessible using useRuntimeConfig() and also through process.env, is there a preferred approach for serverside api routes?
Is there a difference at all?

[cloud hedge]

Yes. Always rely on runtimeConfig

See also
https://youtu.be/_FYV5WfiWvs

[ebon chasm]

in the video, you're using $config in a template and using process.env in the nuxt.config public runtime configuration. You show that the only way to actually change the public variable 'myValue' during runtime, is by defining 'NUXT_PUBLIC_MY_VALUE'

so from what I've understood, by using process.env directly in an api route, i won't have the ability to change the value during runtime, since the NUXT_MY_VALUE property wouldn't even be available due to not using runtimeConfig/useRuntimeConfig()/$config in the first place, is that correct?

[cloud hedge]

correct. You should always use runtimeConfig so you can actually change the values during runtime (hence the name) 👍

[ebon chasm]

thank you! 🙂

[tender cypress]

Hello Alex! Love your videos, following since the first video.

I have this type of question.
I am not using ssr but i want to use private key. Is it safe to use public runtime config variable? Or this is wrong?

[cloud hedge]

Thank you so much 🙏🏻
Really happy to hear that 😊

When using no SSR, all keys are public. I’d suggest to either use a separate nitro instance for an API you can call or do that in the same project. That means you need a server running though

[tender cypress]

So its not safe... Hmm.. Does it mean I should worry about it?
Does Nuxt protect these api keys with some salt in JS after build?

Appreciate your help to community! Means a lot!

[cloud hedge]

If the key should not be exposed (think of stripes Private key) then yes, that’s something to worry about 👀

[cloud hedge]

There is no protection as it wouldn’t help. You could just place a debugger and check when the key is used

[tender cypress]

now i won't be able to sleep

[cloud hedge]

Sorry 🙈

What kind of key is it if I may ask?

Like, which service

[tender cypress]

a discord bot key

[cloud hedge]

Oh yeah, set up an API + reroll the key👌🏻

[tender cypress]

Thank you! 💪
Waiting for new videos