Published Vibe site suddenly on Node instead of Cloudflare Workers — all env vars empty

Ask the community
,
1

Has anyone else seen this?

All my AI features and Stripe billing were working fine on my published site earlier this month. Now everything returns “API key not configured” and /api/stripe/status says configured: false.

Added a diagnostic endpoint to see what’s going on, and on the published site:

  • locals.runtime is undefined
  • process.env has only KUBERNETES_* / POD_* vars
  • all 8 of my declared env vars resolve empty

Back in June the same probe on the same site returned hasRuntime: true with the key present. So it looks like my published site moved from a Cloudflare Worker to a Node container, and the env binding went with it. Nothing changed on my end — env schema in astro.config.mjs is byte-identical to the commit where this last worked.

Things I’ve tried:

  • wix env set → PERMISSION_DENIED (VELO.APP_ENVIRONMENT_UPSERT)
  • npm install to add @wix/secrets → 404 on @wix/locale-dataset-javascript, which isn’t on public npm
  • Velo /_functions/* → 404 on the published site
  • REST Get Secret Value via httpClient.fetchWithAuth, plain and with auth.elevate() → 403 both ways

So I can’t reach a secret at all right now. Two questions:

  1. Is anyone else’s published Vibe site running on Node now instead of Workers?
  2. If this is the new runtime — what’s the supported way to read a secret from an Astro API route?
2

Adding request IDs in case someone can look up the actual rejection reason.

Calling GET https://www.wixapis.com/_api/cloud-secrets-vault-server/api/v1/secrets/name/ANTHROPIC_API_KEY from a server-side Astro route in a Wix-managed Vibe project, via httpClient.fetchWithAuth from @wix/essentials. No API key — this is the framework’s auto-generated token.

Both return 403 {"message":"","details":{}}:

  • plain fetchWithAuth — 1785280447.97611298939521379
  • wrapped in auth.elevate() — 1785280448.22211290212511386

x-wix-responded-by: wix.kore.secrets.v1.secret:GetSecretValue:com.wixpress.kore.secrets-service

The secret exists under that exact name. Two questions:

  1. Does auth.elevate() produce an app identity here, or is it still the site visitor?
  2. Can SECRETS_VAULT.SECRET_READ be granted to my project’s auto-provisioned private app?