403 error when trying to create an environment variable

[TechWatching]

When creating an environment variable with the context set to "all", I have the following error :

Error creating Netlify environment variable: Could not create Netlify environment variable order ID xxxxxxxxxxxxxxxxxxxxx : "403 Forbidden: {"code":403,"message":"Upgrade your Netlify account to set specific scopes"}"

I don't see why it would not be possible to create an environment variable (without setting a specific context), even with a free account

[ramonsnir]

Thank you for reporting the issue! It should indeed be possible.

Can you provide a snippet (without IDs or secrets) or your Terraform code that reproduces the issue?

[TechWatching]

I am using Pulumi Netlify provider generated from Terraform provider. So the code is typescript but looks the same as the HCL code, and I expect behavior to be the same.

const blog = netlify.getSiteOutput({
  name: "xxxxx"
})

const config = new Config()
const nuxtUIKey = config.require("nuxt.UIProLicenseKey")

new netlify.EnvironmentVariable("nuxtUIKeyEnvVar", {
  siteId: blog.id,
  key: "NUXT_UI_PRO_LICENSE", 
  secretValues: [{
    value: nuxtUIKey,
    context: "all"
  }]
})

[ramonsnir]

I have a suspicion that the error code from the Netlify API is wrong: secret values are not available on all plans. Can you try replacing secretValues with values and seeing if you still encounter the issue?

[ramonsnir]

OK. I added a test to the codebase that creates environment variables in a Starter-plan account, and I am able to reproduce the issue. @TechWatching You don't have to try what I wrote about, although that will be your next issue after this is fixed.

[TechWatching]

From what I see in the docs, I can still store secrets in the environment variables. It's just that I won't have the additional security layer that the other plans offer. Am I right?

[ramonsnir]

Yes. The values can be secret strings, and Netlify won't make them available to other customers or send them to browsers, but certain protections won't exist if you only do values and not secretValues. It mostly matters to larger teams, where you might want to hide the values from your colleagues or from your future self (in case of social engineering or recklessness or other cases).

[ramonsnir]

@TechWatching Thank you for reporting the issue! Opened a PR to fix and added a regression test for this case.