Environment variables
Environment variables
Environment variables let you store configuration and secrets that your app needs at build time or runtime, API keys, database URLs, feature flags, without putting them in your code.
In Orbit, go to your project and click the Env vars tab.
How variables are scoped
Orbit has two levels of scope:
| Level | What it affects |
|---|---|
| Project-level | Inherited by every environment in this project |
| Environment-level | Overrides the project value for that specific environment only |
For example, set your DATABASE_URL at the project level, then override it at the Staging environment level to point to a test database.
Adding a variable
- In the Env vars tab, find the section for the scope you want (project-level or a specific environment)
- Click Add variable
- Fill in the Key (e.g.
NEXT_PUBLIC_API_URL) and Value - Optionally check Mark as secret to encrypt the value, secret values cannot be revealed after saving
- Click Add to save the variable
Variable changes take effect on the next deployment. They are not applied to the currently live deployment.
Editing and deleting variables
Click the edit icon next to any variable to change its value or description. Click the delete icon to remove it.
Secret variables can be updated (type a new value and save) but their current value cannot be revealed once saved.
Tips for common frameworks
Next.js: Variables prefixed with NEXT_PUBLIC_ are inlined into the browser bundle. All other variables are server-only. Set them at the project level and they apply to both production and staging.
Vite: Variables prefixed with VITE_ are exposed to the browser. All others are build-time only.
Node.js apps: All variables are available in process.env during the build and at runtime in server mode.
Secrets vs non-secrets
Use Mark as secret for anything sensitive: API keys, database passwords, tokens. Secret values are stored encrypted and never displayed in the UI or logs after the initial save.
Non-secret variables (e.g. NODE_ENV=production, NEXT_PUBLIC_APP_URL=https://myapp.com) can be left unsealed and are visible in the UI.
Never put secret values in your repository. Use environment variables for anything you wouldn't want visible in a public git history.