env
List, set, remove and read the environment variables an application is built and run with.
Environment variables for one application. Each variable has a scope: build reaches the image build, runtime reaches the running application, and both reaches each. Every verb takes --app <app>, or uses the application this directory is linked to. Each also takes --json, --quiet and --help.
| Command | What it does |
|---|---|
env ls | List variables, how each is scoped, and which are secret |
env pull | Write every variable, with its value, to .env.local |
env add | Set one variable, reading its value from stdin unless given |
env rm | Remove one variable |
env reveal | Print one variable’s value, and nothing else |
stechbd env ls
Lists every variable with its scope, whether it is secret, and when it last changed. The panel masks every value on this endpoint, so the output never includes one. Use env pull to write the values to a file, or env reveal to print one.
stechbd env ls [--app <app>]| Option | Description |
|---|---|
--app <app> | The application to read. Defaults to the one this directory is linked to. An id, or the slug in the linked project. |
# List the variables of the linked application
stechbd env ls
# Same list for a named application, as JSON for a script
stechbd env ls --app <app> --jsonstechbd env pull
Writes every variable and its real value to .env.local, or to the file you name. The file is readable only by its owner. The command refuses to replace an existing file unless you pass --force, and it checks this before it asks the panel, because each read is recorded in the audit log.
stechbd env pull [<file>] [--force] [--app <app>]| Option | Description |
|---|---|
<file> | Where to write the values. Defaults to .env.local. |
--force | Replace the file if it already exists. |
--app <app> | The application to read. Defaults to the one this directory is linked to. An id, or the slug in the linked project. |
# Write .env.local for the linked application
stechbd env pull
# Replace an existing production file
stechbd env pull .env.production --force
# Print the path, the counts and any keys that could not be written. No values.
stechbd env pull --jsonstechbd env add
Sets one variable. With no value argument, the value is read from stdin, so a piped value such as cat key.pem stays out of shell history. Interior line breaks are kept, and one trailing newline is removed. An empty stdin is refused, because it is usually a mistake; pass "" as the value to set an empty variable on purpose. Adding a name that already exists is refused unless you pass --force.
stechbd env add <KEY> [<value>] [--scope <build|runtime|both>] [--secret] [--force] [--app <app>]| Option | Description |
|---|---|
<KEY> | The variable name: letters, digits and _, not starting with a digit. |
<value> | The value. Omit it to read the value from stdin. A value typed on the command line is kept in shell history. |
--scope <build|runtime|both> | Where the variable is used. Defaults to both, or to runtime when --secret is given. |
--secret | Mark the variable as secret. env ls shows it as secret. |
--force | Replace the value of a variable that already exists. |
--app <app> | The application to change. Defaults to the one this directory is linked to. An id, or the slug in the linked project. |
# Read a secret from a file, so it stays out of shell history
cat key.pem | stechbd env add SIGNING_KEY --secret
# A plain value for the build and the runtime
stechbd env add API_URL https://api.example.com --scope both
# Replace an existing variable
stechbd env add LOG_LEVEL info --scope runtime --forcestechbd env rm
Removes one variable. The command asks you to confirm first, because a running application that reads the variable loses it at its next deployment. Removing a name that does not exist is refused and changes nothing.
stechbd env rm <KEY> [--yes] [--app <app>]| Option | Description |
|---|---|
<KEY> | The variable to remove. |
--yes | Skip the confirmation prompt. |
--app <app> | The application to change. Defaults to the one this directory is linked to. An id, or the slug in the linked project. |
# Remove a variable after confirming
stechbd env rm LOG_LEVEL
# Remove it without the prompt, for a script
stechbd env rm OLD_TOKEN --yesstechbd env reveal
Prints the plaintext value of one variable to stdout, and nothing else, so it can be captured into another variable. The panel records this as a read of a single secret, which is a different entry in the audit log from the one env pull leaves.
stechbd env reveal <KEY> [--app <app>]| Option | Description |
|---|---|
<KEY> | The variable whose value to print. |
--app <app> | The application to read. Defaults to the one this directory is linked to. An id, or the slug in the linked project. |
# Capture one value into a shell variable
$env:DATABASE_URL = stechbd env reveal DATABASE_URL# Capture one value into a shell variable
export DATABASE_URL=$(stechbd env reveal DATABASE_URL)