Overview
Environment variables are stored at the project level, encrypted with AES-256-GCM at rest. Each variable belongs to a tier (dev, staging, or prod) and can be revealed on demand with an audit log entry.
Create an environment variable
- 1Open your project and click the Env Vars tab.
- 2Click New variable.
- 3Enter a key (e.g. DATABASE_URL) and value.
- 4Choose a tier: dev, staging, or prod.
- 5Click Create — the value is encrypted immediately.
Viewer role restriction
Users with the Viewer role cannot create, update, or reveal environment variables. This is enforced at the API level.
Tiers
Tiers let you maintain separate values for different environments without duplicating keys.
| Tier | Use case |
|---|---|
| dev | Local development values |
| staging | Pre-production testing values |
| prod | Production environment values |
Revealing values
Values are hidden by default. Click the eye icon to reveal a value — this creates an audit log entry recording who revealed it and when.
Audit logging
Every reveal is logged. The audit trail shows who accessed which secret and when. Use this for compliance and security reviews.
Export as .env
Export environment variables as a .env file for local development.
- 1Click the export button in the Env Vars toolbar.
- 2Choose a tier (or all tiers).
- 3The .env file downloads with KEY=VALUE format.
- 4Add it to your .gitignore to prevent accidental commits.