How to access Variables from a JS block

English Forum Questions
1

Hi!

How can I access the variables defined under “Variables and secrets” from a JS block? Currently on v2.0.25.

Cheers,
Kevin

1 Like
2

Thanks for your feedback.
This feature is not currently supported. I have documented this requirement and will evaluate it in the future.

3

Just bumping this question back up. Currently the only way to have a JS block execute API calls to an external application requires us to hard code the API key in the JS block code. Obviously, this exposes the key in the browser and presents a significant security concern. @hongboji do you have any suggestions for an alternative approach? Any idea when we can expect an update so we can access the variables defined under “Variables and secrets” from a JS block? Thanks!

4

Just created a request for this on github: Need to access “Variables and secrets” from a JS block · Issue #9740 · nocobase/nocobase

5

Accessing a secret directly from a JS Block would not be safe, because JS Block code runs in the browser and any secret made available there can be inspected by the user.
For external API calls that require an API key, the recommended approach is to move the request to the server side. You can use Action: Custom Request or Workflow, where variables/secrets can be resolved server-side, or create a small custom server-side plugin/API endpoint that reads the secret and proxies the request. The JS Block can then call that NocoBase endpoint and only receive the non-sensitive result.