Manage Environment Variables

This guide covers how to add, update, and manage environment variables for services deployed on Clank. Environment variables let you pass configuration to your application at runtime — database URLs, API keys, feature flags, and anything else your app reads from the environment.

How environment variables work in Clank

Environment variables are configured per service. When a deployment runs, Clank snapshots the current set of variables and injects them into the container. The application sees them as standard environment variables (accessible via process.env in Node.js, os.environ in Python, etc.).

Caution

Environment variables are snapshotted at deploy time. If you add or change a variable, the running container does not pick up the change until you trigger a new deployment.

Adding environment variables

From the dashboard

1. Open the service in the dashboard.
2. Go to the Environment tab.
3. Click Add Variable.
4. Enter a key (e.g., DATABASE_URL) and a value.
5. Choose whether the variable is a secret (see below).
6. Click Save.

Bulk create

To add multiple variables at once, click Bulk Add in the Environment tab. Paste your variables in KEY=value format, one per line:

DATABASE_URL=postgres://user:pass@db:5432/myapp
REDIS_URL=redis://redis:6379/0
LOG_LEVEL=info

Clank parses each line and creates the variables. Lines starting with # are ignored.

From the API

You can also manage environment variables through the REST API. See the API reference for the POST /api/services/{service_id}/env-vars and related endpoints.

Secrets vs. non-secret variables

Every variable has an is_secret flag that controls how it is stored and displayed.

	Non-secret	Secret
Storage	Stored in the database	Encrypted at rest with Fernet
Dashboard display	Value shown in full	Value shown as ********
Reveal	Always visible	Requires explicit click to reveal (rate-limited)
Injected at runtime	Yes, as a plain environment variable	Yes, as a plain environment variable

Both types are injected identically into the container at deploy time. The distinction only affects how the value is stored and displayed in the dashboard and API responses.

Tip

Mark any variable containing credentials, tokens, or keys as a secret. This prevents accidental exposure when sharing your screen or when team members with viewer roles browse the service settings.

Editing and deleting variables

To edit a variable, click the edit icon next to it in the Environment tab, change the key or value, and save. To delete, click the delete icon and confirm.

Remember: changes take effect only after a new deployment.

Revealing secrets

Secret values are redacted in the dashboard and API responses by default. To view a secret value:

1. Click the reveal icon next to the redacted value.
2. The value is shown temporarily.

Reveal requests are rate-limited to prevent abuse. If you need to reference a secret frequently, consider storing it in a local password manager as well.

Common patterns

Database connection strings:

DATABASE_URL=postgres://user:password@db-host:5432/mydb

Mark as secret since it contains credentials.

Feature flags:

ENABLE_SIGNUPS=true
MAINTENANCE_MODE=false

Non-secret. Safe to leave visible.

Third-party API keys:

STRIPE_SECRET_KEY=sk_live_...
SENDGRID_API_KEY=SG...

Mark as secret.

Next steps

• Set Up a Custom Domain — point your own domain at a deployed service
• Troubleshoot Deployment Failures — diagnose common deployment problems