Environment Variables and Secrets

Securely manage configuration and secrets. All values are encrypted at rest using AES-256-GCM. Env vars are injected into your container at runtime.

Encrypted at rest

All environment variable values are encrypted with AES-256-GCM before storage. They are only decrypted when injected into containers.

API: Replace vs Upsert

Two methods are available for updating env vars via the API:

• PUT /services/:id/env-vars -- Full replace. Existing vars not in the payload are deleted. If any existing key would be removed, confirm with "confirm_destructive": true.
• PATCH /services/:id/env-vars -- Additive upsert. Only the provided keys are created/updated. Missing keys are left untouched. Optionally pass "delete": ["KEY"] to remove specific keys.

PATCH body

{
  "env_vars": [
    { "key": "NEW_VAR", "value": "hello" },
    { "key": "EXISTING_VAR", "value": "updated" }
  ],
  "delete": ["OLD_UNUSED_VAR"]
}

PUT body (destructive replace)

{
  "mode": "replace",
  "confirm_destructive": true,
  "env_vars": [
    { "key": "DATABASE_URL", "value": "postgres://...", "is_secret": true },
    { "key": "NODE_ENV", "value": "production" }
  ]
}

Revealing Secret Values

Secret variables are masked in list responses and in the dashboard. To view a saved secret, click the eye icon in the dashboard, or call the reveal endpoint (requires the Developer role; every reveal is recorded in the workspace audit log):

• POST /services/:id/env-vars/:key/reveal -- Reveal one service env var.
• POST /env-groups/:id/vars/:key/reveal -- Reveal one env group var.

POST body

{ "acknowledge_sensitive_output": true }

Response

{ "key": "DATABASE_URL", "value": "postgres://...", "is_secret": true }

Database Template References

Env var values can reference managed database connection fields using template syntax. References resolve when writing env vars and work with database ID or unique database name.

database references

{
  "env_vars": [
    { "key": "PGHOST", "value": "${{ databases.my-db.host }}" },
    { "key": "PGPORT", "value": "${{ databases.my-db.port }}" },
    { "key": "PGDATABASE", "value": "${{ databases.my-db.db_name }}" },
    { "key": "PGUSER", "value": "${{ databases.my-db.username }}" },
    { "key": "PGPASSWORD", "value": "${{ databases.my-db.password }}", "is_secret": true },
    { "key": "DATABASE_URL", "value": "${{ databases.my-db.internal_url }}", "is_secret": true }
  ]
}

Env Groups

Env groups let you share configuration across multiple services. Define them in your blueprint or create them in the dashboard. When a group is updated, all linked services receive the changes.

railpush.yaml

envVarGroups:
  - name: shared-config
    envVars:
      - key: LOG_LEVEL
        value: info
      - key: SENTRY_DSN
        value: https://abc@sentry.io/123

services:
  - type: web
    name: my-api
    envVars:
      - fromGroup: shared-config
      - key: PORT
        value: "3000"