.env file syntax and secret masking.
Environments
Each variable is set for one environment:production: production deployments.preview: previews of pull requests.
production unless you pass --env preview (or -e preview).
Build, runtime or both
A variable is passed to both by default. Turn one off when a value is only needed in one place:Secrets
Mark API keys, passwords and tokens as secret with--secret. A secret’s value can’t be read back from the panel, the CLI or the API, and it is masked in deployment logs. To change a secret, set a new value.
Values typed on the command line can end up in your shell history. For secrets, use atoll env import with a file you delete afterwards, or the panel.
Set, list and remove
In the panel, use the project’s Env tab. From the CLI:atoll deploy. Pass --project (or -p) to choose another one.
Reading plain values needs the Viewer role; secrets are never shown. Setting and removing needs the Developer role.
When changes apply
Changes apply on the next deployment. To apply them right away, use the Redeploy production button in the panel’s Env tab. It redeploys the latest production deployment.Names and limits
Letters, digits and_, not starting with a digit. PORT is reserved, because the platform sets it for your Ktor servers. Names starting with ATOLL_ are reserved for the platform. A project can have up to 500 variables across both environments, and a value can be up to 64 KB.