Sign inStart buildingStart building

Docs / Build / Environment Variables

Environment Variables

FASTBASE reads your project to learn which settings it expects, fills in everything it can, and asks you only for what it cannot know.

Where they are detected

  • .env.example, .env.sample, .env.template, .env.local.example, .env.dist
  • process.env.NAME and import.meta.env.NAME in your source code

Three kinds

Kind Examples Who sets it
Managed by FASTBASE DATABASE_URL, PG*, FASTBASE_URL, FASTBASE_PUBLIC_KEY, FASTBASE_SECRET_KEY, PORT, NODE_ENV, APP_URL, NEXTAUTH_URL FASTBASE
Generated once JWT_SECRET, SESSION_SECRET, NEXTAUTH_SECRET, AUTH_SECRET, ENCRYPTION_KEY FASTBASE creates a random value and keeps it stable
User required OPENAI_API_KEY, STRIPE_SECRET_KEY You

URL variables such as APP_URL and NEXT_PUBLIC_APP_URL are set to the project’s live address.

Required or optional

In .env.example:

STRIPE_SECRET_KEY=            # empty or a placeholder → required
APP_NAME=My Shop              # a real, non-secret value → used as the default

# optional
SENTRY_DSN=                   # marked optional → never blocks a deployment

A deployment stops before building when a required value is missing, and tells you which.

Setting values

  • Dashboard: project → Environment
  • CLI: fastbase env set KEY=VALUE, or fastbase deploy --env KEY=VALUE / --env-file .env
  • MCP: the fastbase_set_environment tool

Changes apply on the next deployment. A running version keeps the environment it was started with, which is also what a rollback restores.

Per environment

Production, Staging, Preview and Development each have their own values — and their own database.

Secrets

  • Values are encrypted at rest (AES-256-GCM) and are write-only: no screen, API, CLI command or MCP tool returns them.
  • Values are masked in build and runtime logs, even if your app prints its own environment.
  • Your local .env is never uploaded with your source. Send values explicitly with --env-file.
  • Variables prefixed NEXT_PUBLIC_, VITE_ or PUBLIC_ end up in the browser. Never put a secret in one. FASTBASE refuses to alias the secret key to a public name.
  • Managed variables cannot be overwritten or removed by hand.
← PreviousFunctionsNext →Domains