# Set function secret

> Create or update a secret on a function. Marks the function out-of-sync; the next POST /deploy re-publishes the function with the new environment. Keys must match [A-Z_][A-Z0-9_] (uppercase env-var style), be at most 64 characters, and not start with a prefix the runtime reserves: AWS_, _AWS_, LAMBDA_, _HANDLER, _X_AMZN. Those are refused with 400.

`PUT https://api.zavu.dev/v1/functions/{functionId}/secrets/{key}`

Create or update a secret on a function. Marks the function out-of-sync; the next `POST /deploy` re-publishes the function with the new environment. Keys must match `[A-Z_][A-Z0-9_]*` (uppercase env-var style), be at most 64 characters, and not start with a prefix the runtime reserves: `AWS_`, `_AWS_`, `LAMBDA_`, `_HANDLER`, `_X_AMZN`. Those are refused with `400`.

## Parameters

- `functionId` (path, string, required): Zavu Function ID.
- `key` (path, string, required)

## Body

- `value` (string, required)

## Responses

### 200

Secret updated.

### 201

Secret created.

### 400

Invalid key or value.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

### 401

Unauthorized.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

### 404

Function not found.

- `code` (string, required)
- `message` (string, required)
- `details` (object)

## Example

```bash
curl -X PUT "https://api.zavu.dev/v1/functions/function_abc123/secrets/key_abc123" \
  -H "Authorization: Bearer $ZAVUDEV_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "value": "string"
}'
```

```typescript
import Zavudev from "@zavudev/sdk";

const zavu = new Zavudev({ apiKey: process.env.ZAVUDEV_API_KEY });

await zavu.functions.secrets.set("key_abc123", {
  functionId: "function_abc123",
  value: "string",
});
```