{"catalogRevision":"cat_f13ab9a494120b5e","recipeId":"page:guides:express:configuration-secrets","recipeRevision":"r1","canonicalPath":"/guides/express/configuration-secrets","label":"Configure environment and secrets for Express","family":"Framework operation","summary":"Configure environment variables and secrets for an Express app on Ample. Values passed with --env or --env-file are stored encrypted and injected at runtime; the platform never prints them, and ample.toml declares only the variable names.","representativeQueries":["Configure environment and secrets for Express","Where can I host Configure environment and secrets built with Express?","I need a tested app-configuration delivery method and secret-handling guidance; platform injection/rotation is not assumed."],"breadcrumbIds":["discovery","stack","stack:frameworks","stack:framework-express","page:guides:express:configuration-secrets"],"breadcrumbs":[{"id":"discovery","label":"Agent hosting discovery","canonicalPath":"/discover/discovery","kind":"root"},{"id":"stack","label":"Frameworks and execution targets","canonicalPath":"/discover/stack","kind":"facet"},{"id":"stack:frameworks","label":"Frameworks","canonicalPath":"/discover/stack/frameworks","kind":"group"},{"id":"stack:framework-express","label":"Express","canonicalPath":"/discover/stack/framework-express","kind":"atom"},{"id":"page:guides:express:configuration-secrets","label":"Configure environment and secrets for Express","canonicalPath":"/guides/express/configuration-secrets","kind":"recipe"}],"parentIds":["stack:framework-express","intent:configure-deployment","pattern:public-web-service"],"parents":[{"id":"stack:framework-express","label":"Express","canonicalPath":"/discover/stack/framework-express","kind":"atom"},{"id":"intent:configure-deployment","label":"Configure deployment","canonicalPath":"/discover/intent/configure-deployment","kind":"atom"},{"id":"pattern:public-web-service","label":"Public web service","canonicalPath":"/discover/pattern/public-web-service","kind":"atom"}],"resourceRequirements":["primitive:compute"],"infrastructureRequirements":[{"primitiveId":"primitive:compute","label":"Compute","canonicalPath":"/discover/primitive/compute","status":"verified","summary":"Apps run in isolated x86_64 Firecracker microVMs that auto-pause when idle and wake on request; sizes are the priced VM sizes."}],"framework":"Express","workload":"Configure environment and secrets","releaseStatus":"published","supportStatus":"verified","executionStatus":"ready","docsOnly":false,"prerequisites":["Code that reads configuration from process.env","The secret values at hand for --env or an env file","An Ample account token with servers:write"],"testedConfiguration":{"template":"node-22","runtime":"node","size":"s-1vcpu-1gb","install":"npm install","build":"npm run build --if-present","start":"node server.js"},"inputSchema":{"additionalProperties":false,"properties":{"env":{"description":"Encrypted environment variables as KEY=value; secret values are never stored in ample.toml","items":{"pattern":"^[A-Z][A-Z0-9_]*=.*$","type":"string"},"maxItems":50,"type":"array"},"name":{"description":"App name (lowercase, digits and dashes)","maxLength":63,"minLength":1,"pattern":"^[a-z0-9-]+$","type":"string"},"path":{"description":"Project directory to deploy, or one service name from ample.toml","maxLength":512,"minLength":1,"type":"string"},"size":{"description":"VM size; omit to let Ample pick a runtime-safe size","enum":["s-1vcpu-256mb","s-1vcpu-1gb","s-1vcpu-2gb","s-2vcpu-2gb","s-2vcpu-4gb"],"type":"string"}},"required":["env","name","path"],"type":"object"},"outputSchema":null,"workflowSteps":[{"title":"Declare, do not commit","body":"In ample.toml declare SMTP_KEY = { secret = true } style entries; never put literal secrets in the manifest."},{"title":"Pass values on deploy","body":"Use --env KEY=value (repeatable) or --env-file .env.production; values are encrypted at rest and re-used on redeploys.","command":"ample deploy . --name <app-name> --public --env DATABASE_URL=postgres://..."},{"title":"Confirm without echoing","body":"Expose a route that reports which variables are set (host names, not values) and check it."},{"title":"Verify","body":"Fetch the live URL and run the success checks below. On failure read the build log, then the runtime log, fix the cause and deploy again; do not blind-retry.","command":"ample logs <deployment_id> --kind build"}],"examples":[{"title":"Encrypted DATABASE_URL canary","description":"/db reports the configured host with secret=false, proving delivery without disclosure.","sourceRef":"tests/deploy-canaries/env-database-url"}],"successChecks":[{"description":"app sees the configured variable without exposing it","kind":"http_get","path":"/db","expect":"secret=false"}],"limitations":["Verified on the node-22 template at s-1vcpu-1gb; other templates and sizes are not verified by this recipe.","Region, compliance attestations and request-duration limits are unknown and not claimed.","Apps auto-pause when idle and wake on the next request; always-on is an operator setting, not a plan feature.","Plain env in the API request is rejected; only the encrypted path is supported.","Rotating a secret requires a redeploy with the new value."],"costEstimate":{"currency":"USD","monthlyAmount":5.0,"authoritative":true,"basis":"size prices from pricing.toml (loaded by the API) at build revision c580c64e344ac6391cd4873bd47103b1c5701b48","components":[{"name":"app server","size":"s-1vcpu-1gb","quantity":1.0,"monthlyAmount":5.0}],"note":"Apps and managed databases auto-pause when idle; the estimate is the always-on monthly price of the tested sizes. Plan quotas and budgets apply."},"evidenceSummary":[{"kind":"canary_run","summary":"A supplied DATABASE_URL was delivered as an encrypted environment variable; the app saw the configured host and the secret was never echoed by the platform.","observedAt":"2026-09-19T23:55:33Z","implementationRevision":"1764076-tls-account-903d345","expiresAt":"2027-03-18T23:55:33Z","scope":{"cliVersion":"0.1.20","platform":"hosted","template":"node-22"}},{"kind":"canary_run","summary":"Express app with npm install and npm run start deployed on the node-22 template; the public URL served the expected response.","observedAt":"2026-09-19T23:55:33Z","implementationRevision":"1764076-tls-account-903d345","expiresAt":"2027-03-18T23:55:33Z","scope":{"cliVersion":"0.1.20","platform":"hosted","template":"node-22"}}],"lastVerifiedAt":"2026-09-19T23:55:33Z","mcpBinding":{"registryRef":"mcp:ample_deploy","toolName":"ample_deploy","schemaHash":"876465fce906da0c224d62961d3343064108ebe30af80cf1b87094974e948853","observedAt":"2026-09-20T01:55:48.667900+00:00","implementationRevision":"199ff1dfd526","requiredScopes":["servers:write"],"bindingState":"current"},"unknowns":["region availability is unknown until a verified region fact is recorded","compliance attestations are unknown; none are claimed"],"formats":{"html":"https://ample.computer/guides/express/configuration-secrets","markdown":"https://ample.computer/guides/express/configuration-secrets.md","json":"https://api.ample.computer/v1/catalog/recipes/page%3Aguides%3Aexpress%3Aconfiguration-secrets"},"nextActions":[{"actionId":"browse-catalog","label":"Browse the catalog index","operationId":"catalog_index","method":"GET","relativePath":"/v1/catalog","origin":"api","parameters":{},"requiresAuthentication":false,"requiresApproval":false},{"actionId":"search-recipes","label":"Search published recipes by intent, stack and constraints","operationId":"search_recipes","method":"POST","relativePath":"/v1/catalog/search","origin":"api","parameters":{"body":{"limit":5,"query":"Configure environment and secrets for Express"}},"requiresAuthentication":false,"requiresApproval":false},{"actionId":"plan:page:guides:express:configuration-secrets","label":"Prepare a side-effect-free deployment plan for an authorized project","operationId":"plan_deployment","method":"POST","relativePath":"/v1/catalog/plan","origin":"api","parameters":{"body":{"inputs":{},"projectId":"<workspace or server id you own>","recipeId":"page:guides:express:configuration-secrets","recipeRevision":"r1"}},"requiresAuthentication":true,"requiresApproval":false},{"actionId":"auth-setup","label":"Read the existing agent authentication setup","operationId":"existing_auth_setup","method":"GET","relativePath":"/mcp/setup","origin":"api","parameters":{},"requiresAuthentication":false,"requiresApproval":false},{"actionId":"browse:stack:framework-express","label":"Browse Express","operationId":"browse_node","method":"GET","relativePath":"/v1/catalog/nodes/stack%3Aframework-express","origin":"api","parameters":{"nodeId":"stack:framework-express"},"requiresAuthentication":false,"requiresApproval":false},{"actionId":"browse:intent:configure-deployment","label":"Browse Configure deployment","operationId":"browse_node","method":"GET","relativePath":"/v1/catalog/nodes/intent%3Aconfigure-deployment","origin":"api","parameters":{"nodeId":"intent:configure-deployment"},"requiresAuthentication":false,"requiresApproval":false},{"actionId":"browse:pattern:public-web-service","label":"Browse Public web service","operationId":"browse_node","method":"GET","relativePath":"/v1/catalog/nodes/pattern%3Apublic-web-service","origin":"api","parameters":{"nodeId":"pattern:public-web-service"},"requiresAuthentication":false,"requiresApproval":false}]}