Variables and secrets

Where they're set

• Shared variables on the project's page go to every app of the project.
• An app's Variables tab has its own, on top of the shared ones; its worker can have more (Settings → Worker).
• Linked resources add theirs: DATABASE_URL and POSTGRES_* from a database, REDIS_URL and REDIS_* from a cache, S3_* from a storage. hakobu also sets PORT and SENTRY_DSN.

When a name is set in more than one place, the app's own value wins over the shared one, which wins over the linked ones. The Variables tab shows what the app gets in the end.

Changes apply on the next deploy.

Sealed variables

A secret (an API key, a payment provider's token) belongs in a sealed variable. Its value is passed to the containers but never shown again, not even to you: someone who gets into the panel can't copy it. Seal the same name again to replace a value. Projects, apps and workers each have their own.

Claude never sets a secret: it asks you to seal it (see Claude).

Encrypted at rest

Every variable, sealed or not, is encrypted in the panel's database with its master key, kept apart from the data: a copy of the database alone reads nothing. See Security.