Environment variables

Scopes & precedence

Per key, the most specific definition wins:

Shared variables flow to every app of the project — a DATABASE_URL defined once reaches the web app and the worker. Define an app-scoped row with the same key to override it for that app only. One app's scoped variables are invisible to the others.

Secrets

• All values are encrypted at rest (AES-256-GCM).
• Secret-marked values additionally never enter container image layers: at build time they are provided through BuildKit secret mounts; at runtime through the orchestrator's secret store.
• Names that look sensitive (*_SECRET, *_API_KEY, *_PASSWORD, *_TOKEN, *_PRIVATE_KEY, *_SERVICE_KEY…) get secret handling automatically. Public prefixes (NEXT_PUBLIC_, VITE_, REACT_APP_, NUXT_PUBLIC_) are always treated as plain.

Build time vs runtime

Every variable is available during the build (framework prerendering, codegen) and at runtime. Remember that changing a variable takes effect on the next deploy — frameworks that inline values at build time (all NEXT_PUBLIC_* usage) need a rebuild to pick up changes.

Bulk import

Paste an entire .env file — in the project creation wizard, or any time into the add-variable dialog:

DATABASE_URL=postgres://user:pass@host:5432/db
RESEND_API_KEY=re_xxxxxxxxxxxx
NEXT_PUBLIC_SITE_URL=https://example.com

Keys and values parse like dotenv (quotes stripped, comments ignored). Empty values are allowed.

Pull from envfyio

If your secrets already live in envfyio, connect it on the project's Environment tab instead of copying values across. Buildfyio authenticates with a Universal Auth machine identity and pulls the secrets addressed by workspace, environment and path.

• The sync is one-directional. envfyio owns the keys it provides and overwrites them on every pull; keys that exist only in Buildfyio are left untouched. Nothing is ever written back to envfyio.
• With Sync before every deploy on, the pull runs before the build is queued — a secret you rotate in envfyio reaches that build, not the one after it.
• If envfyio is unreachable the deploy still runs, on the values already cached here. The failure is shown on the integration panel rather than blocking a release.