Environment Variables

Hosted websites can be configured with environment variables — API keys, feature flags, and other settings your site needs. Values are encrypted at rest and injected into builds and the running site, so secrets never need to live in your source files.

Environments

Each website has three environments, each with its own set of variables:

• production — the default, used by the live site
• staging
• preview

Switch between them with the tabs in the Environment panel on the website’s page.

Setting a variable

1. Open the Environment panel

   Go to the website’s page in the portal and find the Environment panel.

2. Enter the key and value

   Keys follow the usual environment-variable format (letters, digits, and underscores, starting with a letter or underscore).

3. Choose where it is injected

   • Build-time — available while the site is being built. Required for values a framework inlines during the build, such as Next.js NEXT_PUBLIC_* variables.
   • Runtime — available to the server code of server-rendered sites on every request. This is the default.

   A variable can be both; build-only secrets like package registry tokens should be build-time only.

4. Save

   The value is encrypted and stored. Setting an existing key rotates its value.

Try asking your agent

“Set the STRIPE_SECRET_KEY environment variable on the storefront site’s production environment.”

Secrets handling

• Values are encrypted at rest (AES-256-GCM)
• Secret values are hidden in the portal after saving, and are never returned to agents — an agent can set or rotate a value but not read it back
• Every change is recorded in an audit trail, including rotations
• Values are capped at 32 KiB per variable

Tip

Rotating a leaked key is a single step: set the same key again with the new value. Runtime variables apply to server-rendered sites on their next deployment or rollback; build-time variables apply on the next build.

Next steps

• Builds and Deployments — Where build-time variables are consumed.
• Website Hosting — Overview of the hosting platform.