---
title: "Environment variables"
description: "Manage encrypted project secrets and make them available to cloud workspace commands."
canonical_url: "https://hoplite.sh/docs/sandboxes/environment-variables"
markdown_url: "https://hoplite.sh/docs/sandboxes/environment-variables.md"
---

# Environment variables
URL: /docs/sandboxes/environment-variables
LLM index: /llms.txt
Description: Manage encrypted project secrets and make them available to cloud workspace commands.
Related: /docs/sandboxes, /docs/sandboxes/scripts, /docs/workspace

# Environment variables and secrets

Configure project environment variables once under **Settings → Project → Environment**. Hoplite stores secrets encrypted and injects them into the sandbox shell for **every command the agent runs**, including setup scripts, dev servers, tests, and ad-hoc shell calls.

## Manage variables

The editor works like a staged `.env` file:

- **Add** keys one at a time, or **paste a whole `.env`** into the key field to import multiple entries at once — multi-line values like PEM keys are handled
- Changes stage as **New / Updated / Removed** and apply together when you save, with undo before saving
- **Deletes** ask for confirmation

## Reserved names

Project variables cannot use `PATH`, `ENV`, `BASH_ENV`, `LD_PRELOAD`, `LD_LIBRARY_PATH`, `GIT_EXEC_PATH`, `GIT_CONFIG`, or any name beginning with `GIT_CONFIG_`. Hoplite reserves these names for workspace execution, rejects them when saving variables, and filters them out of existing project values before injection. Install tools or configure application paths through [setup scripts](/docs/sandboxes/scripts) instead of overriding these execution controls.

## Security model

Values are **encrypted at rest** and **never shown again** after saving — the UI displays only that a value exists, not its content. Treat them accordingly: if you need to check a value, rotate it rather than trying to read it back.

Values are available to code executing in the sandbox, including dependencies and tests. Encryption at rest does not prevent that code from reading its environment. See [Security](/docs/workspace/security#project-secrets) for the execution boundary.

## Sitemap

Sitemap discovery is not enabled for this deployment.