Documentation

Server variables

Server variables keep secrets — download URLs, API keys, config, feature flags — off the client until a paying user asks for them.

Define variables under Variables in the dashboard: a name, a value and a requiredLevel. The value never ships in your binary — your app fetches it at runtime, and only if the logged-in user's level is high enough.

curl
curl -X POST function(){throw Error("Attempted to call BASE() from the server but BASE is on the client. It's not possible to invoke a client function from the server, it can only be rendered as a Component or passed to props of a Client Component.")}/api/1.x/var \
  -H "Authorization: Bearer <app-session>" \
  -H "Content-Type: application/json" \
  -d '{"session":"<user-session-id>","name":"cdn_url"}'
200
{ "success": true, "name": "cdn_url", "value": "https://cdn.example.com/build.zip" }

If the user's level is below the variable's requiredLevel you get 403; an unknown name is 404. Because the value only exists server-side, cracking the client binary reveals nothing.

Every SDK exposes a one-liner: var("cdn_url").

PreviousBlacklist & bansNextGated downloads