Environment variables

Keys, passwords and settings for your app, kept out of your code and encrypted at rest.

Adding variables

Open a project, then Environment. Add a key and a value, or paste a whole .env file and Wrenship splits it into variables. Names use letters, digits and underscores, and can't start with a digit.

New and changed values are used from the next deploy. Redeploy to apply them right away.

Scopes

A variable set for one scope wins over the same name set for all environments.

Secrets

Variables are secret by default: the value is encrypted when it's saved and is hidden in the dashboard. Developers and above can reveal a secret when they need it, and every reveal is recorded in the activity log. AI apps never see secret values. Turn Secret off for values that aren't sensitive, such as a public API URL.

A .env file in your upload or repository is never published. Wrenship warns you and asks you to add its values here instead.

Build time and run time

• Static sites read variables while they build. Front-end tools only bake in names with their public prefix, such as VITE_ or PUBLIC_. Anything baked in is visible to every visitor, so never put a secret there.
• Server-rendered apps also get every variable at run time, in your server code. Secrets stay on the server and never reach the browser.

Variables Wrenship sets for you

Variables Wrenship sets are marked system. If you set the same name yourself, yours wins.