Deno "PermissionDenied: Requires env access" in CI

Deno denied access to an environment variable because --allow-env was not granted. In CI this often hits secrets or config the program reads through Deno.env.get.

What this error means

The program stops with "PermissionDenied: Requires env access to \"VAR_NAME\", run again with the --allow-env flag" when it reads process env.

error: Uncaught (in promise) PermissionDenied: Requires env access to "DATABASE_URL", run again with the --allow-env flag
    at Object.getEnv (ext:deno_os/30_os.js:...)

Common causes

No --allow-env in the CI command

The program calls Deno.env.get("VAR") but the step does not grant env access, so the read is denied.

The variable is outside a scoped env grant

A scoped --allow-env=CI does not cover other variables like DATABASE_URL that the program also reads.

How to fix it

Grant access to the variables you read

1. Read the variable name in the error.
2. Add --allow-env=VAR1,VAR2 listing the variables the program uses.
3. Ensure those variables are set in the step env.

deno run --allow-env=DATABASE_URL,PORT mod.ts

Set the variables and grant env in the workflow

Provide the values in the step env and pass the matching --allow-env list.

- run: deno run --allow-env=DATABASE_URL mod.ts
  env:
    DATABASE_URL: ${{ secrets.DATABASE_URL }}

How to prevent it

• List exact variable names in --allow-env rather than granting all env.
• Keep the env grant in sync with the variables the program reads.
• Provide required variables in the step env so reads succeed.

Related guides