Secrets and environment variables

Environment variables configure your app at runtime — no rebuild, no commit. Hyze stores the values alongside the app and injects them when the process starts.

When to use

Use environment variables for:

Database URLs (DATABASE_URL)
External service API keys
Session and webhook secrets
Feature flags and per-environment configuration

{
  "envVars": {
    "NODE_ENV": "production",
    "DATABASE_URL": "postgresql://user:pass@host:5432/db"
  }
}

Rules the API enforces

The API rejects reserved keys like NODE_ENV, PORT, PATH, HOME, and prefixes like HYZE_, DOCKER_, AWS_. Prefer application names: APP_ENV, DATABASE_URL, and similar. PUT /api/apps/:appId/env merges the variables you send into the existing environment — it doesn’t replace everything.

Common sense

Never commit secrets to version control
Use clear, descriptive variable names
Rotate leaked keys immediately
Keep production and development values separate

Changed a variable? Restart

Variables are injected when the process starts. After updating values used during boot, restart the app.

Next steps

Manage secrets

Update app environment variables.

Env endpoint

Reference for PUT /api/apps/:appId/env.

Last modified on September 1, 2026

​When to use

​Rules the API enforces

​Common sense

​Changed a variable? Restart

​Next steps