Manage Environment Variables

Temps environment variables are set per project and scoped to one or more environments; each value is encrypted at rest and reaches your containers on the next deployment. You can keep a variable out of preview deployments, and Temps injects its own variables (bind address, port, API token, replica number, linked-service credentials) at deploy time.

For server settings such as TEMPS_DATABASE_URL and the ClickHouse variables, see the Environment Variables Reference.


Add a variable

  1. Open your project in the dashboard
  2. Click Environment Variables in the sidebar
  3. Click Add Variable
  4. Enter the key and value
  5. Select which environments this variable applies to (e.g. production, staging, or all)
  6. Click Save

The variable takes effect on the next deployment. Existing running containers are not updated — you need to redeploy for changes to take effect.

Sensitive values: Variable values are encrypted at rest with AES-256-GCM under the instance's master key (~/.temps/encryption_key), but anyone with dashboard access to the project can view a regular variable. Mark a variable as secret (--secret in the CLI, "is_secret": true in the API) to make it write-only: the dashboard masks it and the API never returns its value. The flag is one-way; to make a secret readable again, delete it and create it anew. For database and storage credentials, use Temps' managed services where possible — they generate the credentials and inject them for you.


Scope variables to environments

Each variable can be assigned to one or more environments. This is how you use different configurations across production, staging, and development.

Common pattern:

KeyProductionStaging
API_URLhttps://api.yourapp.comhttps://api-staging.yourapp.com
LOG_LEVELwarndebug
ENABLE_DEBUG(not set)true

To set a variable for a specific environment:

  1. When adding or editing a variable, select only the environments you want it applied to
  2. Create separate variables with the same key but different values for different environments

If the same key exists for multiple environments, each environment gets its own value. There is no inheritance — a variable scoped to production does not automatically appear in staging.


Preview environment controls

Each variable has an Include in Preview toggle. When disabled, the variable is not injected into preview environments.

Use this to:

  • Keep production API keys out of preview branches
  • Exclude payment processor credentials from temporary environments
  • Control feature flags per environment type

To change this setting:

  1. Go to Environment Variables in your project
  2. Find the variable you want to adjust
  3. Toggle Include in Preview on or off

Variables from linked managed services (like POSTGRES_URL) are always included in all environments, including previews. Each preview gets its own isolated database.


Auto-injected variables

Temps injects these variables at deploy time. You don't need to set them yourself. This is the single list for the docs; other pages link here.

Injected into every deployment

VariableValueNotes
HOST0.0.0.0Bind address, so the process listens on all interfaces and port mapping works. It's a default: set HOST yourself and your value wins.
PORTThe port Temps routes traffic toReplaces a PORT you set yourself; to change it, set the port on the project or environment (port resolution). Not set for Docker Compose projects. See the version note below.
TEMPS_API_URLhttps://<your-temps-instance>/apiTemps API endpoint for the SDKs (visitor enrichment, email and other platform APIs).
TEMPS_API_TOKENGeneratedDeployment token for the Temps API. Omitted if the token can't be created.
CRON_SECRETSame value as TEMPS_API_TOKENLets your app verify Authorization: Bearer <CRON_SECRET> on scheduled requests.
TEMPS_NODE_NAMENode running this replicacontrol-plane on a single-node install.
TEMPS_NODE_IDID of that node0 on a single-node install.
TEMPS_REPLICAThis replica's number, starting at 1Lets one replica take on a single-instance job (for example a scheduled task) without every replica racing.
TEMPS_ASSET_PREFIX/_temps/assets/<deployment>Per-deployment path for static assets. Next.js projects also get NEXT_PUBLIC_TEMPS_ASSET_PREFIX.

PORT in v0.1.0-beta.56. The released binary sets PORT on deployments built from Git and on image deployments, but not when you roll back or promote a deployment. Its value is the configured port (environment, then project, then 3000), even when the image's EXPOSE directive makes Temps route to a different port. Nightly builds since 2026-08-30 set PORT on every deploy path. Read it with a fallback (process.env.PORT ?? 3000) and keep the configured port and EXPOSE the same.

When managed services are linked

VariableSource
POSTGRES_URL, POSTGRES_HOST, etc.Linked PostgreSQL service
REDIS_URL, REDIS_HOST, etc.Linked Redis service
DATABASE_URL, MYSQL_URL, MARIADB_URLLinked MariaDB service
MONGODB_URL, MONGODB_HOST, etc.Linked MongoDB service
S3_BUCKET, S3_ENDPOINT, etc.Linked S3/RustFS service

Databases aren't created automatically: create the service, then link it to the project. See Deploy with a Database for the full list.

Error tracking

Temps injects a Sentry-compatible DSN for the project's error tracking:

VariableValue
SENTRY_DSNThe project's error-tracking DSN, for server-side code
NEXT_PUBLIC_SENTRY_DSN / VITE_SENTRY_DSN / PUBLIC_SENTRY_DSNThe same DSN under the browser-visible name your framework expects (Next.js / Vite-based / SvelteKit, Astro, Rsbuild)
SENTRY_RELEASEThe deployment's commit SHA

OpenTelemetry

Injected alongside TEMPS_API_URL, so OpenTelemetry SDKs export to Temps without extra configuration:

VariableDescription
OTEL_EXPORTER_OTLP_ENDPOINTTemps OTLP endpoint (<TEMPS_API_URL>/otel)
OTEL_EXPORTER_OTLP_PROTOCOLhttp/protobuf
OTEL_EXPORTER_OTLP_HEADERSAuthentication and project headers
OTEL_SERVICE_NAMEThe project name
OTEL_SERVICE_VERSIONThe deployment's commit, when available

Port resolution order

Temps picks the container port, and so the PORT value, in this order:

  1. exposed_port setting on the environment
  2. exposed_port setting on the project
  3. EXPOSE directive in the built image
  4. Default: 3000

In v0.1.0-beta.56 and earlier, the image's EXPOSE directive takes priority over a configured exposed_port. See Resource Settings.


Use the API

List variables

curl "https://your-temps-instance/api/projects/{project_id}/env-vars?environment_id={env_id}" \
  -H "Authorization: Bearer YOUR_TOKEN"

Create a variable

curl -X POST "https://your-temps-instance/api/projects/{project_id}/env-vars" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "key": "API_KEY",
    "value": "your-api-key",
    "environment_ids": [1, 2],
    "include_in_preview": false
  }'

Update a variable

curl -X PUT "https://your-temps-instance/api/projects/{project_id}/env-vars/{var_id}" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "key": "API_KEY",
    "value": "new-value",
    "environment_ids": [1, 2],
    "include_in_preview": false
  }'

Delete a variable

curl -X DELETE "https://your-temps-instance/api/projects/{project_id}/env-vars/{var_id}" \
  -H "Authorization: Bearer YOUR_TOKEN"

Get a single value

curl "https://your-temps-instance/api/projects/{project_id}/env-vars/{key}/value" \
  -H "Authorization: Bearer YOUR_TOKEN"

Referencing other variables

Temps stores variable values exactly as you enter them. It doesn't expand references to other variables, so a value such as $POSTGRES_URL reaches your app as that literal text, not as the connection string.

If your framework expects DATABASE_URL, point it at the injected variable in your app's configuration instead. For example, with Prisma:

datasource db {
  provider = "postgresql"
  url      = env("POSTGRES_URL")
}

See Deploy with a Database for the variables each managed service injects.


Last updated

Was this page helpful?