Security & Secrets

Isolation#

Every Upstash Box runs in its own isolated container with a dedicated filesystem, process tree, and network stack. Boxes cannot communicate with or observe each other. Network access is restricted — containers cannot reach private networks, cloud metadata services, or other internal infrastructure.

Environment Variables#

You can pass environment variables when creating a box. These are available to all code running inside the box, including your agent and any user-submitted code.

const box = await Box.create({  runtime: "node",  env: {    DATABASE_URL: "postgres://...",    ANTHROPIC_API_KEY: "sk-ant-...",  },})

box = Box.create(    runtime="node",    env={        "DATABASE_URL": "postgres://...",        "ANTHROPIC_API_KEY": "sk-ant-...",    },)

Attach Headers#

For injecting secret HTTP headers into outbound HTTPS requests without exposing them inside the container, see Attach Headers.

Browser URLs#

Boxes created with browser: true can hand out two kinds of URLs that carry their access token in the URL itself, so they work without an API key:

• Live view URLs are view-only. Frames stream out and no input goes in, but anyone with the URL can watch the tab.
• CDP URLs give full control of the browser to anyone holding them.

Treat both as secrets and share them only where that level of access is intended. Recording playlist URLs are not tokenized. Fetching them requires your Box API key, like any other API call.

Blocked Environment Variables#

For system security, the following environment variables cannot be set. If you pass them in env when creating a box, they are ignored. Saving them as account-level environment variables fails with a 400 error.

All other environment variables — including ANTHROPIC_API_KEY, OPENAI_API_KEY, and their *_BASE_URL variants — are allowed. The built-in agent runner uses its own isolated environment that overrides these per-run.