change env var name so it's never sent to the client bundle

README.md

@@ -12,7 +12,7 @@ Open [http://localhost:3000](http://localhost:3000) with your browser to see the
 In order to get data from the Strapi server at `api.renci.org`, you need to provide an API token as an environment variable to be used in the request `Authorization` header. For development, create a `.env` file in the root of the project.
 
 ```env
-NEXT_PUBLIC_ACCESS_TOKEN=YOUR_API_TOKEN
+STRAPI_ACCESS_TOKEN=YOUR_API_TOKEN
 ```
 
 ## Deployment
@@ -22,7 +22,7 @@ This project contains a [Github Action workflow](./.github/workflows/build-image
 The GH action uses a [robot account token](https://goharbor.io/docs/1.10/working-with-projects/project-configuration/create-robot-accounts/) with permissions to create artifacts and tags. If you modify or update this account in Harbor, make sure to change the `USER` and `PW` in the Github secrets settings.
 
 ### Strapi API access token
-For the deployed environment, the `NEXT_PUBLIC_ACCESS_TOKEN` environment variable is provided to the Next.JS container using a Secret called `renci-dot-org-api`, which has one variable called `token`. You can check if a secret already exists:
+For the deployed environment, the `ACCESS_TOKEN` environment variable is provided to the Next.JS container using a Secret called `renci-dot-org-api`, which has one variable called `token`. You can check if a secret already exists:
 
 ```bash
 kubectl get secrets -n YOUR_NAMESPACE_HERE

kubernetes/values.yaml

@@ -5,7 +5,7 @@ image:
   tag: latest
 
 env:
-  - name: NEXT_PUBLIC_ACCESS_TOKEN
+  - name: STRAPI_ACCESS_TOKEN
     valueFrom:
       secretKeyRef:
         name: renci-dot-org-api

lib/strapi/fetchStrapiGraphQL.js

@@ -3,7 +3,7 @@ export const fetchStrapiGraphQL = async (query, preview = false) => {
     method: "POST",
     headers: {
       "Content-Type": "application/json",
-      Authorization: `Bearer ${process.env.NEXT_PUBLIC_ACCESS_TOKEN}`,
+      Authorization: `Bearer ${process.env.STRAPI_ACCESS_TOKEN}`,
     },
     body: JSON.stringify({ query }),
   }).then((response) => response.json());

utils/api.js

@@ -10,7 +10,7 @@ export async function fetchAPI(path, options = {}) {
     headers: {
       "Content-Type": "application/json",
       Authorization:
-          `Bearer ${process.env.NEXT_PUBLIC_ACCESS_TOKEN}`,
+          `Bearer ${process.env.STRAPI_ACCESS_TOKEN}`,
     },
   };
   const mergedOptions = {