SetCloud
✦ Ask AI Get started

Environment variables and secrets

A deployment needs config — a database connection string, a payments key, a feature flag — without any of it living in your repo. This page covers where that config comes from and how it reaches your running app.

Environment variables

Plain configuration is set per project. Container and custom serverless projects receive it at runtime; static-site projects receive it at build time, where it may become public output. Anything that isn’t a credential — a base URL, a flag, a region name — belongs here.

Secrets Vault values

Anything sensitive belongs in the Secrets Vault instead. A secret is created in the vault and linked to a runtime environment variable. Vault values are not supplied to repository builds. Never print them or put them into browser-visible output. Static sites cannot safely hold a server credential; call your own authenticated backend.

How values are injected

When your project has a database attached, its connection string is injected into the running app as DATABASE_URL automatically — you never copy or paste it. Vault-managed secrets you attach to a project are injected the same way when a new instance starts. Existing instances keep their current environment values.

Reading by reference at runtime

Server applications can also use the Secrets SDK to read a linked secret by its friendly name or environment alias:

import { getSecret } from '@setcloud/secrets';
const credentials = JSON.parse(await getSecret('prod/database'));

SetCloud supplies the application’s temporary identity. Only secrets linked to that deployment are readable; no access keys or secret values belong in the code. Adding or removing links requires a redeploy to update the application access policy. Runtime reads are metered and appear in the audit log after event processing, which can take several minutes.

Rotating without redeploying source

Updating a secret’s value in the Vault creates a new version — it doesn’t touch your source or require a code change. The Secrets SDK reads the current version on its next call by default, so a running application can refresh credentials without a redeploy. An optional SDK cache delays refresh until its expiry; force a fresh read when needed. Environment-variable injection still requires a new instance or redeploy to pick up a new value.

Next