Netlify has the variable but the app cannot use it

1. Open the failing deploy.

   Select the Netlify project, open Deploys and choose the deployment serving the failing URL. Record its context and revision. Read the deploy log for the first relevant failure and confirm which build command actually ran.

2. Inspect context and scope together.

   Open Project configuration, Environment variables and find the required name. Inspect its production value and available scopes. A build-time setting needs Builds; a serverless function reading a secret needs Functions. Record which consumer is failing before changing a scope.

3. Check repository overrides.

   Open netlify.toml in the project, if it exists. Search for the variable name and compare any context-specific configuration. Values set there override the same name set through the UI, CLI or API. Do not move secrets into this committed file.

4. Deploy the corrected configuration.

   After correcting the intended context and scope, start a new deploy. Open its deploy details and then reproduce the original failing function or page. A clean build log does not substitute for calling the function that needed the setting.

WORKSThe new production deploy’s intended consumer reads its setting and completes the action.

BROKENThe value is shadowed, scoped elsewhere or absent from the failing deploy context.

Ranked in the order to investigate, not by claimed frequency.

1. The value belongs to another deploy context.

   Provide the intended Production value while preserving separate preview values where needed. Recheck the deployment URL so a preview success is not mistaken for production repair.

2. The variable is scoped to Builds but needed by Functions.

   Make it available to the function through Netlify’s environment settings. Keep it out of browser-exposed build output; server execution is what allows that credential to remain private.

3. netlify.toml overrides the dashboard entry.

   Remove or correct the conflicting non-secret configuration in the repository and redeploy. For secrets, keep the authoritative value in the secure environment interface rather than in source control.

• Netlify’s Runtime scope refers to specific platform features; it is not a general substitute for the Functions scope. Choose the scope documented for the actual consumer.
• A frontend framework can embed a build value into JavaScript. A value reaching the build does not guarantee secrecy after the build completes.

When to stop and hand it over

Stop if you cannot determine whether the failed read happens in a build, a function or browser code. Supply the deploy context, scope labels and relevant netlify.toml keys with values removed. Ask for the failing consumer to be identified before broadening access.