Vercel env vars via the API

scripts/vercel_env.py talks to api.vercel.com directly. It is an upsert, so re-running is safe, and list never prints values.

Requires

VERCEL_TOKEN (Account Settings -> Tokens). For a project owned by a team, also VERCEL_TEAM_ID=team_...: without it every call is scoped to your personal account and the project "does not exist". If the token is missing, ask for one; do not try to obtain it any other way.

Commands

python3 scripts/vercel_env.py list --project my-site
python3 scripts/vercel_env.py set CRON_SECRET=$(python3 -c "import secrets;print(secrets.token_urlsafe(32))") --project my-site
python3 scripts/vercel_env.py set-from-env STRIPE_SECRET_KEY OPENAI_API_KEY --project my-site

• Default targets are production,preview. Add --target production,preview,development to cover local vercel dev too.
• set-from-env copies a value already exported in your shell, so a secret is never retyped into a command line or chat.

After setting a var

A new env var does not reach an existing deployment. Redeploy (push a commit, or POST /v13/deployments with the last deployment's deploymentId and target: production), then check the function that reads it.

Security

• list prints key names and targets only.
• Values are written type: "encrypted"; the script has no path to read a value back.
• Never put a token in a commit, a log line or a chat message.