Hi!
I used netlify function:create and choosed Token-Hider as a template.
In my netlify-dashboard there is no environment-variable set yet. After changing the Template-URL to Google-Places-API (const URL = https://maps.googleapis.com/maps/api/place/details/json?key=${API_SECRET}&${API_PARAMS}) I commited to github and netlify ran the build-process - all good up to here.
But… how is it possible that running that deployed function by calling https://....netlify.app/.netlify/functions/[functionname] this gives my a valid answer? The function log shows me, that the URL was build correctly -but how? Where does the variable ${API_SECRET} come from???
Totally confused 
and hope for help
Here the full code of that function
const axios = require("axios");
const qs = require(“qs”);
exports.handler = async function(event, context) {
// apply our function to the queryStringParameters and assign it to a variable
const API_PARAMS = qs.stringify(event.queryStringParameters);
console.log(“übergebene Parameter API_PARAMS”, API_PARAMS);
// Get env var values defined in our Netlify site UI
// TODO: customize your URL and API keys set in the Netlify Dashboard
// this is secret too, your frontend won’t see this
const { API_SECRET } = process.env;
const URL = https://maps.googleapis.com/maps/api/place/details/json?key=${API_SECRET}&${API_PARAMS};
console.log(“Zusammengesetzte URL ist …”, URL);
try {
const { data } = await axios.get(URL);
// refer to axios docs for other methods if you need them
// for example if you want to POST data:
// axios.post(’/user’, { firstName: ‘Fred’ })
return {
statusCode: 200,
body: JSON.stringify(data),
};
} catch (error) {
const { status, statusText, headers, data } = error.response;
return {
statusCode: error.response.status,
body: JSON.stringify({ status, statusText, headers, data }),
};
}
};