fromscratch
Help center

Environment variables

Store secret keys (Stripe, Shopify, any external service) safely in the Variables menu, and understand when they apply to the preview and to the live site.

Updated 3 min read
On this page
  1. What a variable is
  2. Add or change a variable
  3. Where variables go
  4. Common uses
  5. Variables and versions
  6. FAQ
  7. Related

Many sites need secret values: a payment key, an access token for an external service, an email provider's password. These must never be written in the chat or in the pages of your site. FromScratch gives every project a Variables menu for exactly this.

What a variable is

A variable is a pair KEY = value, for example STRIPE_API_KEY = sk_live_…. Your app reads the value by its key when it runs, without the value ever appearing in the code or in the conversation. Names use letters, digits and underscores, and cannot start with a digit; by convention they are in capitals.

Add or change a variable

  1. Open the project and click Variables in the top bar. The panel is titled « Environment variables ».
  2. In the empty row, type the name in KEY and the value in value, then click Add.
  3. Repeat for each variable. Values are masked; use Show / Hide to check one, and the delete button to remove a row.
  4. Click Save. You get « Variables saved — active on the next backend restart, and updated on the published site ».

Warning

never paste a secret key in the chat, even to « help » the agent. Put it in Variables, then tell the agent the variable's name (« the key is in STRIPE_API_KEY »). The agent is instructed never to print keys either.

Where variables go

  • In the preview: the values are written into your project's settings file (the panel shows where) and are used the next time your app's server restarts. The agent can restart it, or simply ask it to use the new value.
  • On the published site: variables are injected into the live site as real environment variables. If the project is already published, saving updates the live site right away (it restarts with the new values) — no republish needed. A new publication also reads the latest values just before it goes live.

FromScratch only manages its own block of variables: if the agent added settings of its own to the same file, they are kept when you save.

Common uses

Need Variables
Card payments in a shop (own keys) STRIPE_API_KEY + STRIPE_PUBLISHABLE_KEY — or use Connect Stripe in Payments, which fills them for you
Import a Shopify catalog that blocks public access SHOPIFY_ACCESS_TOKEN + SHOPIFY_STORE_DOMAIN (or SHOPIFY_CLIENT_ID + SHOPIFY_CLIENT_SECRET)
Any external service your app calls the key names the agent asks you for
Example prompt
I added my weather service key in Variables as WEATHER_API_KEY. Use it to show today's forecast for Lyon on the home page.

See Take payments in your store and Add products or import your catalog.

Variables and versions

Secrets are deliberately kept out of Versions: going back to an older version never brings back an old key or erases a new one.

FAQ

I saved a variable but nothing changed.

In the preview, the value is used after the next restart of your app's server: ask the agent to apply it. On the live site, check that you clicked Save; if the change still doesn't show, republish.

Can collaborators see my variables?

People you share the project with as Editor work in the same project, including its Variables menu. Share edit access only with people you trust.

Should I remove a token after using it?

If it was only needed once (for example a Shopify import), yes: delete the row, save, and revoke the token in the service that issued it.

Was this page helpful?