Secrets · Guides
Add and change variables
Each environment has its own variables. Every add, change and removal is a numbered change in its history, so nothing you do here is lost.
An environment's page is under Variables: open the tab, then the environment's name. Its own tabs are Variables, History and .env, and the switch beside its name opens the same page in another environment.
Add a variable
Choose Add a variable, type its name and value, and choose Secret or Visible. It goes into this environment only; to have it in staging and production too, add it there as well, with the value each needs.
Secret is the default: the value is hidden until someone shows it. Visible is for what there's nothing to hide about, such as an address or a host, and is suggested as you type a name like that. Make a value Visible explains both.
To add many at once, import a .env.
Names and values
| Name | UPPER_SNAKE: a capital letter first, then capitals, digits and _, at most 64 characters. What you type is upper-cased, so db_password becomes DB_PASSWORD. A name is in an environment once: to give it another value, change it. |
| Value | Kept exactly as typed, with its line breaks and nothing trimmed, so a certificate or a private key fits. It may be empty. At most 32 KB, and never a NUL byte. |
A value is encrypted the moment it arrives. How many variables an environment holds depends on the project's package: see Limits.
Find a variable
The box above the list finds variables by name as you type. Beside it, a switch narrows the list, each choice with a count:
- Secret and Visible: one kind only.
- Changed in 7 days: the ones added or changed lately.
- Missing here: names another environment has and this one lacks, so a machine reading this one goes without them. Each has Add to this environment beside it.
- Different: names whose value here differs from another environment's.
- Could be Visible: Secret ones whose name and value look like nothing to hide.
Each row says which other environments lack the name or hold another value. Compare environments shows the whole picture.
Show or copy a Secret value
A Visible value is in its row, with Copy. A Secret one has two buttons instead:
- Show puts the value in its row. Leave the page and it's hidden again.
- Copy puts it on the clipboard without showing it.
Both are written in the project's audit log, with who and when. They take Triage or Admin in the environment; with Viewer you see names and Visible values only. See Control who sees values.
Change a value
Change opens a box in the row. Type the new value and Save. It changes this environment only, and the old value stays in the history, so the change can be rolled back. Saving the value it already has changes nothing and adds nothing to the history.
A machine gets the new value from its next read: the next mybeast-secrets pull, or the next start with mybeast-secrets run. An app reading a .env that's already written keeps the old value until then. The Tokens page shows which machines haven't read since: Where each token stands.
Remove a variable
Remove is behind the row's ⋯, and asks first. Machines stop getting the variable from their next read.
A removal can be undone