Manage Environment Variables
Temps environment variables are set per project and scoped to one or more environments; each value is encrypted at rest and reaches your containers on the next deployment. You can keep a variable out of preview deployments, and Temps injects its own variables (bind address, port, API token, replica number, linked-service credentials) at deploy time.
For server settings such as TEMPS_DATABASE_URL and the ClickHouse variables, see the Environment Variables Reference.
Add a variable
- Open your project in the dashboard
- Click Environment Variables in the sidebar
- Click Add Variable
- Enter the key and value
- Select which environments this variable applies to (e.g. production, staging, or all)
- Click Save
The variable takes effect on the next deployment. Existing running containers are not updated — you need to redeploy for changes to take effect.
Sensitive values: Variable values are encrypted at rest with AES-256-GCM under the instance's master key (~/.temps/encryption_key), but anyone with dashboard access to the project can view a regular variable. Mark a variable as secret (--secret in the CLI, "is_secret": true in the API) to make it write-only: the dashboard masks it and the API never returns its value. The flag is one-way; to make a secret readable again, delete it and create it anew. For database and storage credentials, use Temps' managed services where possible — they generate the credentials and inject them for you.
Scope variables to environments
Each variable can be assigned to one or more environments. This is how you use different configurations across production, staging, and development.
Common pattern:
| Key | Production | Staging |
|---|---|---|
API_URL | https://api.yourapp.com | https://api-staging.yourapp.com |
LOG_LEVEL | warn | debug |
ENABLE_DEBUG | (not set) | true |
To set a variable for a specific environment:
- When adding or editing a variable, select only the environments you want it applied to
- Create separate variables with the same key but different values for different environments
If the same key exists for multiple environments, each environment gets its own value. There is no inheritance — a variable scoped to production does not automatically appear in staging.
Preview environment controls
Each variable has an Include in Preview toggle. When disabled, the variable is not injected into preview environments.
Use this to:
- Keep production API keys out of preview branches
- Exclude payment processor credentials from temporary environments
- Control feature flags per environment type
To change this setting:
- Go to Environment Variables in your project
- Find the variable you want to adjust
- Toggle Include in Preview on or off
Variables from linked managed services (like POSTGRES_URL) are always included in all environments, including previews. Each preview gets its own isolated database.
Auto-injected variables
Temps injects these variables at deploy time. You don't need to set them yourself. This is the single list for the docs; other pages link here.
Injected into every deployment
| Variable | Value | Notes |
|---|---|---|
HOST | 0.0.0.0 | Bind address, so the process listens on all interfaces and port mapping works. It's a default: set HOST yourself and your value wins. |
PORT | The port Temps routes traffic to | Replaces a PORT you set yourself; to change it, set the port on the project or environment (port resolution). Not set for Docker Compose projects. See the version note below. |
TEMPS_API_URL | https://<your-temps-instance>/api | Temps API endpoint for the SDKs (visitor enrichment, email and other platform APIs). |
TEMPS_API_TOKEN | Generated | Deployment token for the Temps API. Omitted if the token can't be created. |
CRON_SECRET | Same value as TEMPS_API_TOKEN | Lets your app verify Authorization: Bearer <CRON_SECRET> on scheduled requests. |
TEMPS_NODE_NAME | Node running this replica | control-plane on a single-node install. |
TEMPS_NODE_ID | ID of that node | 0 on a single-node install. |
TEMPS_REPLICA | This replica's number, starting at 1 | Lets one replica take on a single-instance job (for example a scheduled task) without every replica racing. |
TEMPS_ASSET_PREFIX | /_temps/assets/<deployment> | Per-deployment path for static assets. Next.js projects also get NEXT_PUBLIC_TEMPS_ASSET_PREFIX. |
PORT in v0.1.0-beta.56. The released binary sets PORT on deployments built from Git and on image deployments, but not when you roll back or promote a deployment. Its value is the configured port (environment, then project, then 3000), even when the image's EXPOSE directive makes Temps route to a different port. Nightly builds since 2026-08-30 set PORT on every deploy path. Read it with a fallback (process.env.PORT ?? 3000) and keep the configured port and EXPOSE the same.
When managed services are linked
| Variable | Source |
|---|---|
POSTGRES_URL, POSTGRES_HOST, etc. | Linked PostgreSQL service |
REDIS_URL, REDIS_HOST, etc. | Linked Redis service |
DATABASE_URL, MYSQL_URL, MARIADB_URL | Linked MariaDB service |
MONGODB_URL, MONGODB_HOST, etc. | Linked MongoDB service |
S3_BUCKET, S3_ENDPOINT, etc. | Linked S3/RustFS service |
Databases aren't created automatically: create the service, then link it to the project. See Deploy with a Database for the full list.
Error tracking
Temps injects a Sentry-compatible DSN for the project's error tracking:
| Variable | Value |
|---|---|
SENTRY_DSN | The project's error-tracking DSN, for server-side code |
NEXT_PUBLIC_SENTRY_DSN / VITE_SENTRY_DSN / PUBLIC_SENTRY_DSN | The same DSN under the browser-visible name your framework expects (Next.js / Vite-based / SvelteKit, Astro, Rsbuild) |
SENTRY_RELEASE | The deployment's commit SHA |
OpenTelemetry
Injected alongside TEMPS_API_URL, so OpenTelemetry SDKs export to Temps without extra configuration:
| Variable | Description |
|---|---|
OTEL_EXPORTER_OTLP_ENDPOINT | Temps OTLP endpoint (<TEMPS_API_URL>/otel) |
OTEL_EXPORTER_OTLP_PROTOCOL | http/protobuf |
OTEL_EXPORTER_OTLP_HEADERS | Authentication and project headers |
OTEL_SERVICE_NAME | The project name |
OTEL_SERVICE_VERSION | The deployment's commit, when available |
Port resolution order
Temps picks the container port, and so the PORT value, in this order:
exposed_portsetting on the environmentexposed_portsetting on the projectEXPOSEdirective in the built image- Default:
3000
In v0.1.0-beta.56 and earlier, the image's EXPOSE directive takes priority over a configured exposed_port. See Resource Settings.
Use the API
List variables
curl "https://your-temps-instance/api/projects/{project_id}/env-vars?environment_id={env_id}" \
-H "Authorization: Bearer YOUR_TOKEN"
Create a variable
curl -X POST "https://your-temps-instance/api/projects/{project_id}/env-vars" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"key": "API_KEY",
"value": "your-api-key",
"environment_ids": [1, 2],
"include_in_preview": false
}'
Update a variable
curl -X PUT "https://your-temps-instance/api/projects/{project_id}/env-vars/{var_id}" \
-H "Authorization: Bearer YOUR_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"key": "API_KEY",
"value": "new-value",
"environment_ids": [1, 2],
"include_in_preview": false
}'
Delete a variable
curl -X DELETE "https://your-temps-instance/api/projects/{project_id}/env-vars/{var_id}" \
-H "Authorization: Bearer YOUR_TOKEN"
Get a single value
curl "https://your-temps-instance/api/projects/{project_id}/env-vars/{key}/value" \
-H "Authorization: Bearer YOUR_TOKEN"
Referencing other variables
Temps stores variable values exactly as you enter them. It doesn't expand references to other variables, so a value such as $POSTGRES_URL reaches your app as that literal text, not as the connection string.
If your framework expects DATABASE_URL, point it at the injected variable in your app's configuration instead. For example, with Prisma:
datasource db {
provider = "postgresql"
url = env("POSTGRES_URL")
}
See Deploy with a Database for the variables each managed service injects.
Related concepts
- Environments — the scopes your variables are assigned to
- Projects and Deployments — where variables are defined and when they're applied
- Resource Settings — CPU, memory, replicas and ports per environment
- Environment Variables Reference — server, CLI and SDK variables