Secrets and variables

env holds one encrypted set per project environment, plus team-wide shared sets. Apps read them at deploy time; CI and your laptop read them through the CLI.

Set and remove

xvii env set --project shop --env production STRIPE_KEY=sk_live_… WEBHOOK_SECRET=…
xvii env set --project shop --env production LOG_LEVEL=info --plain
xvii env unset --project shop --env preview OLD_FLAG
xvii env ls

Values are secret by default: the panel shows their names, and revealing one is logged. --plain marks a value that isn't secret and may be shown.

--project and --env default to XVII_PROJECT and XVII_ENV (then CI_ENVIRONMENT_NAME), so inside a project you can set them once.

Kinds

Kind	Delivered as
`var`	an environment variable
`file`	a file at a path, mode 600; the variable holds the path
`ssh`	an Ed25519 key pair made here: the public half shows, the private one is a file

References

A value can refer to another, resolved when it is read and never past the reader's rights:

DATABASE_URL=${{ shared.MAIN_DB }}
API_URL=${{ project:billing.production.PUBLIC_URL }}

Run with the variables

xvii env run --project api --env preview -- go test ./...
xvii env pull --project web --env preview            # write .env
xvii env pull --files --force                        # also files and SSH keys
eval "$(xvii env export --format shell)"
xvii env export --format json | jq .

run writes files to a private temporary folder for the command and removes them after; nothing else touches the disk.

Versions

Every change is a new version of the whole set. The panel shows the history with who changed which names; any version can be restored.

Who can do what

Role	Unprotected environments	Protected environments	Shared sets
viewer	names	names	names
developer	read and change	names	names
admin	read and change	read and change	read and change

Reveals and resolves are in the journal with the names read.

Public build variables

Variables a frontend build inlines (VITE_, PUBLIC_, NEXT_PUBLIC_) end up in files anyone can download. Never give a secret such a prefix, and remember a change to env doesn't rebuild a bundle that already contains the old value.

Encryption

Each set has its own XChaCha20-Poly1305 data key, sealed with the instance's master key; each value is bound to its set and name. The master key lives in env's data folder: back it up with the database (backups does), or the values can't be opened after a restore.