Skip to content
Helicarrier Cloud

Environment variables

Environment variables configure your services without hard-coding secrets into your code. On Helicarrier Cloud they are encrypted at rest, masked in the dashboard, and injected into your container at deploy time.

Add a variable

Section titled “Add a variable”

Open a service’s Variables tab and add a KEY and value, then Set. The value field is a growing textarea, so multiline secrets — a JSON service account, a PEM private key — can be pasted with real newlines, no escaping required.

Variables apply on the next deploy: because they are injected when the container starts, saving a variable does not restart your running service — deploy (or push) to pick it up.

Edit a variable in place

Section titled “Edit a variable in place”

To change an existing variable, click edit on its row. The current value is revealed into an editable field where you can change it and save (or press ⌘/Ctrl-Enter to save, Esc to cancel). No need to re-type the key.

Reveal, copy, and export

Section titled “Reveal, copy, and export”

Values are masked as •••••• by default. Revealing a value is a deliberate, confirmed action — click the eye icon and confirm. You can then:

  • Reveal a single value inline.
  • Copy one value, or Copy all as KEY=value lines.
  • Download the whole set as a .env file.

Reveal and export are audit-logged, so there is a record of when secrets were exposed.

Encryption & safety

Section titled “Encryption & safety”
  • Values are sealed with AES-256-GCM encryption at rest.
  • The dashboard and API never return secret values in the clear — they are masked.
  • Secrets are decrypted only when injected into your container at deploy; logs never carry plaintext secrets.

Managed and referenced keys

Section titled “Managed and referenced keys”

Two kinds of variables are read-only in the editor:

  • Managed database credentials — a managed database’s own connection variables are set by the platform and cannot be edited by hand.
  • Reference-set keys — a variable whose value comes from a service reference is controlled by that link; remove the reference to edit it directly.

Next

Section titled “Next”