Environment variables and keys

A Project's environment variables are part of its setup. Every Workspace started from the Project deploys with them, so a key is set once for the whole team rather than per person.

Where they come from

While Soffi sets your app up, it works out which variables the app reads and sets the ones it needs to start. When the app runs on a Data Twin, the Data Twin stands in for the backend those keys would normally reach, so most apps need no real credentials at all.

Soffi never invents a real secret. A made-up key deploys fine and then fails at the first request, so when the app needs one Soffi can't supply, she asks you for it instead.

See a Project's keys

Open the Project from Projects in the left rail, go to Configure, and choose Secret keys. The tab shows:

• A status line. "All required keys are set", or, when something is missing, a Needs your key section with a field for each key Soffi can't supply.
• Services. What the saved setup runs.
• Keys. Every variable the Project has. A dot shows whether it has a value, a Secret badge marks values stored as secrets, and the service that uses the key is named beside it.

The list never shows a value back. Secret values are encrypted at rest.

Add a key for a third-party service

When your app calls a service like a payments or email provider and you want it to use a real key in Soffi, declare the key in your run configuration and leave the value out:

[[env]]
key = "STRIPE_SECRET_KEY"
sensitive = true

A sensitive key can't carry a value in the file, so the next time you open Secret keys it appears under Needs your key. An Admin enters the value there and saves it, and it ships with the next deploy. Values that aren't secret, like the base URL of a provider's test environment, can sit in the file directly with value.

Use a scoped, least-privilege key: a test-mode or read-only credential where the provider offers one. Previews are for building and reviewing, and they don't need production access.

Who can do what

Admins and Owners enter key values. Editors can open the Secret keys tab but can't change anything in it.

If you turn on automatic PR visuals, read its note on setup secrets first: a comparison runs the pull request's own code while the Project's keys are present.