---
title: "Environment variables"
description: "Encrypted per-project secrets, injected into every command the agent runs"
canonical_url: "https://hoplite.sh/docs/sandboxes/environment-variables"
markdown_url: "https://hoplite.sh/docs/sandboxes/environment-variables.md"
---

# Environment variables
URL: /docs/sandboxes/environment-variables
LLM index: /llms.txt
Description: Encrypted per-project secrets, injected into every command the agent runs
Related: /docs/sandboxes/scripts, /docs/workspace

# Environment variables

Projects carry a set of environment variables under **Settings → Project → Environment**. They're injected into the sandbox shell for **every command the agent runs** — setup scripts, dev servers, tests, ad-hoc shell calls.

## Managing variables

The editor works like a staged `.env` file:

- **Add** keys one at a time, or **paste a whole `.env`** into the key field to import multiple entries at once — multi-line values like PEM keys are handled
- Changes stage as **New / Updated / Removed** and apply together when you save, with undo before saving
- **Deletes** ask for confirmation

## Security model

- Values are **encrypted at rest** and **never shown again** after saving — the UI displays only that a value exists, not its content
- Treat them accordingly: if you need to check a value, rotate it rather than trying to read it back

<Callout type="tip" title="What belongs here">
API keys for services your app talks to, database URLs, feature flags — anything you'd put in a local `.env`. If your setup script needs a secret (say, a private registry token), this is where it comes from.
</Callout>

## Sitemap

See the full [sitemap](/docs/sitemap.md) for all pages.
Well-known sitemap: [/docs/.well-known/sitemap.md](/docs/.well-known/sitemap.md).