Variables and secrets

Setting them

On the project's Variables tab, or from a terminal. A change takes effect on the next deployment.

arrah env set my-api STRIPE_KEY=sk_live_...     # ends up in shell history
arrah env set my-api --from-file .env.production
arrah env list my-api                            # names only
arrah env unset my-api OLD_KEY

Write-only

A value is encrypted with AES-256-GCM before it is stored, and no page, command or API call returns it — not to you, a team member or an agent. To change a value you replace it. Values are also masked wherever they would appear in a log, as [REDACTED].

Up to 100 variables per project. PORT is set by the platform and cannot be overridden.

What the platform sets for you

With a database

DATABASE_URL, PGHOST, PGPORT, PGUSER, PGPASSWORD, PGDATABASE

With Redis

REDIS_URL, REDIS_HOST, REDIS_PORT, REDIS_PASSWORD

With file storage

S3_ENDPOINT, S3_PUBLIC_ENDPOINT, S3_BUCKET, S3_REGION, S3_ACCESS_KEY_ID, S3_SECRET_ACCESS_KEY, and the matching AWS_* names

A variable you set yourself under the same name wins.

Using a provided value under another name

Some software wants the connection under a name of its own. A value may contain ${NAME} for any of the names above, plus APP_URL and APP_HOST for the project's own address. It is filled in when the application starts.

DB_HOST      ${PGHOST}
JDBC_URL     jdbc:postgresql://${PGHOST}:${PGPORT}/${PGDATABASE}
PUBLIC_URL   ${APP_URL}/

Anything else in that form is left exactly as written.