Skip to content

Functions Reference

varlock provides several powerful functions that allow for dynamic and composable environment variable values. This reference covers all available functions, their arguments, and usage examples.

The varlock() function is used to handle encrypted values. It decrypts the provided encrypted string at runtime.

# @sensitive
API_KEY=varlock("encrypted_string_here")
  • encrypted_string (string, required): The encrypted value to be decrypted
# @sensitive
DATABASE_PASSWORD=varlock("oipjfdopiajpfoidjpaoijpofdjpoa...")

The fallback() function provides a way to specify multiple possible values, using the first non-empty value in the list.

VALUE=fallback("", undefined, "default-value")
  • Multiple values (any type): The function will use the first non-empty value in the list
# TODO: add examples

The concat() function combines multiple strings into a single string.

PATH=concat("base/", ref("ENV"), "/config.json")
  • Multiple strings (string): The strings to be concatenated
# Simple concatenation
API_URL=concat("https://", ref("DOMAIN"), "/api")
# Complex path construction
CONFIG_PATH=concat("config/", ref("ENV"), "/", ref("REGION"), ".json")

The eval() function executes a command and uses its output as the value. This is useful for integrating with external tools and services.

SECRET=eval(`op read "op://vault/item/credential"`)
  • command (string, required): The command to execute
# Using 1Password CLI
API_KEY=eval(`op read "op://dev test/${OP_VAULT}/credential"`)
# Using AWS CLI
AWS_CREDENTIALS=eval(`aws sts get-session-token --profile prod`)

The ref() function references the value of another environment variable. This is equivalent to using ${VARIABLE} syntax.

NEW_VAR=ref("EXISTING_VAR")
  • variable_name (string, required): The name of the variable to reference
# Simple reference
API_URL=concat("https://", ref("DOMAIN"), "/api")
# Nested references
CONFIG_PATH=concat("config/", ref("ENV"), "/", ref("REGION"), ".json")

Functions can be composed together to create complex value resolution logic. Here are some examples:

# Using multiple functions together
API_URL=concat("https://", ref("DOMAIN"), "/", ref("API_VERSION"))
# Dynamic configuration with eval
CONFIG=eval(`aws ssm get-parameter --name "/config/${ENV}" --with-decryption`)