AXHubAXHub
⌘K

Env variables

Keep settings like API keys and DB URLs out of your code and inject them at build or run time.

Environment variables are where you keep settings that shouldn't be hard-coded — API keys, DB URLs, and the like. AxHub encrypts and stores them, then injects them when it builds or runs your app. In code you just read them by name, like process.env.DATABASE_URL.

Where to set them

Web console — App detail → Environment variables tab → Add variable. Set Key, Value, and Stage.

Adding or changing an env var takes effect on the next deploy — it doesn't update the running app automatically. (The Key can't be changed after creation; you can only edit the value and Stage.)

CLI — you can also use axhub env set. See From the CLI below.

Naming rules

A Key must start with an uppercase letter and use only uppercase letters, digits, and underscores (_) — the pattern ^[A-Z][A-Z0-9_]*$.

DATABASE_URL   OPENAI_API_KEY   NEXT_PUBLIC_API_URL   ✅
databaseUrl    1ST_KEY          MY-KEY                ❌

Stage — when it's injected

Choose when the value is available.

StageWhen it's injectedExamples
Runtime (default)Only in the running pod (absent at build)DB passwords, external API keys
BuildOnly as a build-arg at build time (absent at runtime)Tokens needed only to build
BothAt both build and runtimeWhen both stages need it
  • Runtime-only values never land in build logs or the image cache — keep secrets at Runtime.
  • Values that go into the frontend bundle (NEXT_PUBLIC_, VITE_, PUBLIC_) are exposed in the browser as-is. Never put secrets under those names.

Handling secrets

A value stored as a secret is masked as *** in screens and responses, and encrypted at rest. Never put it in code, git, or a manifest — declare only the name and Stage, and keep the value in env vars.

From the CLI

# Plain value — pass KEY VALUE directly
axhub env set NEXT_PUBLIC_API_URL https://api.example.com --app demo --plain --stage build

# Secret value — read it from stdin so it isn't recorded in your shell history
axhub env set DATABASE_URL --app demo --secret --stage runtime --from-stdin

axhub env list --app demo
axhub env get DATABASE_URL --app demo

With --secret, pass the value via --from-stdin instead of the positional arg (keeps it out of shell history and logs).

Declare in the manifest

In axhub.yaml you list only the name and stage — never the value.

axhub.yaml
env:
  required:
    - name: DATABASE_URL
      scope: runtime
    - name: NEXT_PUBLIC_API_URL
      scope: build

The manifest's scope means the same as the console/CLI Stage (build · runtime · both). The full schema is in the axhub.yaml reference.