# Environment variables

Values your deployed app receives through `process.env` when it is built and run. Put values here that must not
go into the repository, such as API keys or the addresses of outside services.

```
list_env_vars    the variables there are now. Sensitive values show only the last four characters
set_env_vars     save one or more. variables, or dotenv (a whole .env file)
remove_env_var   delete from one target (production or preview)
```

## Where they apply

You choose with `targets`. `production` is deployments of the production branch, `preview` is every other branch.
The same name can hold different values in each: a test key for previews, the real key for production.
Only owners and admins can change production values.

## When changes take effect

**A changed value is used in builds from the next deployment on.** Values baked into an existing build don't change.
Apps that run as a server receive the new value the next time they start.

## Names you can't use

`PORT`, `HOST`, `HOSTNAME`, `HOME` and names starting with `BLACKWALL_` are used by the platform. Builds get `CI=1` unless you set `CI` yourself (for example `CI=false`).
Values the platform provides:

```
BLACKWALL_ENV              production or preview
BLACKWALL_URL              the address this deployment is served at (a host name)
BLACKWALL_GIT_COMMIT_SHA   the commit that was built
BLACKWALL_GIT_BRANCH       the branch that was built
```

## Automatic variables

This project's address and keys are set without anything being saved, under the names Supabase uses (`automatic` in list_env_vars, the console's environment variables screen, `oneend env ls`). Where each is available (`available_in`) differs.

```
                                                           Available in
SUPABASE_URL, NEXT_PUBLIC_SUPABASE_URL                     Build and runtime   https://<ref>.<zone>
SUPABASE_ANON_KEY, NEXT_PUBLIC_SUPABASE_ANON_KEY,
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY                       Build and runtime   the publishable key (follows access rules)
SUPABASE_SERVICE_ROLE_KEY                                  Runtime only        the secret key (bypasses access rules; server code only)
DATABASE_URL, POSTGRES_URL                                 Production runtime  pooler 6543 (only while the password is kept)
DIRECT_URL                                                 Production runtime  direct 5432 (only while the password is kept)
```

Runtime is servers, middleware and functions. The service role key never goes to builds (the install and build commands, where the scripts of the packages an app depends on run).
A variable saved under the same name is used instead, and a saved value goes to builds too. A preview of a git branch that has a database branch gets the branch's values.
`DATABASE_URL`, `POSTGRES_URL` and `DIRECT_URL` go to production servers, middleware and functions (never builds or previews) only while a password made with `reset_database_password { ref, keep_for_deploys: true }` is kept (console: Database connection → Make new password → "Keep it for my production deploys"). Like the secret key, that connection reads every row. Make a new password without `keep_for_deploys` and it is no longer handed over.
`oneend env pull` writes only the public ones to .env.local. A Vite app reads names with another prefix, such as `VITE_SUPABASE_URL`; save those yourself.

## Sensitive values

A value saved with `sensitive: true` can never be read back afterwards. Use it for secret keys.
Without `sensitive`, a variable whose name contains SECRET, TOKEN, PASSWORD, PRIVATE, DSN, DATABASE_URL or KEY_, or ends in _KEY, is saved as sensitive (`sensitive_keys` in the answer). Give `sensitive: false` to keep it readable.
Values that are not sensitive are also stored encrypted. The only difference is whether they are shown again.

## Values that reach the browser

Names that frameworks put into browser code, such as `NEXT_PUBLIC_` and `VITE_`, **end up in the build as they are, where anyone can see them.**
Never use such names for secret keys.

---

https://end.blackall.ai/docs/env?lang=en