Environment variables

Configuration and secrets for your services — encrypted at rest, masked in the UI, and injected into your app at build and runtime.

Adding variables

Project → Environment:

  • Add variable — one key/value at a time.
  • Bulk paste — paste a whole .env file; comments and blank lines are ignored, quoted values are unquoted:
# pasted as-is from your local .env
DATABASE_URL=postgresql://user:pass@host:5432/db
STRIPE_SECRET_KEY="sk_live_..."
NEXT_PUBLIC_API_URL=https://api.example.com

Changes apply to the next deployment — redeploy to roll them out to running services.

Security model

  • Values are encrypted with AES-256-GCM before they reach the database. Plaintext values are never written to disk or logs.
  • After saving, values are write-only in the UI: you see a mask, not the value.
  • Reveal decrypts a single value on demand — every reveal is recorded in your team's audit log with who, what, and when.
  • Values are never included in client-side JavaScript unless you prefix the key with your framework's public convention (NEXT_PUBLIC_, PUBLIC_, VITE_).

Naming rules

Keys must match [A-Za-z_][A-Za-z0-9_]* — letters, digits, and underscores, not starting with a digit. Keys are unique per project; setting an existing key overwrites its value.

Build-time vs runtime

All variables are available in both phases. Remember that variables prefixed for client exposure are baked into the build output — treat them as public.