# Environment variables

Environment variables are how your app reads configuration at runtime without hardcoding it in the source. A good rule of thumb: anything that differs between development and production, or that's secret, belongs here.

Common examples:

- `DATABASE_URL` — where your app reads and writes data.
- `STRIPE_SECRET_KEY` — an API key you can't commit to git.
- `LOG_LEVEL` — `debug` locally, `info` in production.
- `PORT` — which port your app listens on.

## Set one or more variables

```sh
dina apps env set --app my-app DATABASE_URL=postgres://localhost/mydb
```

You can set multiple variables in a single command by listing them space-separated:

```sh
dina apps env set --app my-app \
  DATABASE_URL=postgres://db.internal/prod \
  LOG_LEVEL=info \
  FEATURE_FLAGS=checkout-v2,search-refresh
```

The CLI prints each variable that was set. Values can contain any characters that your shell can quote — if your value has spaces, quote the whole pair:

```sh
dina apps env set --app my-app GREETING="Hello, world"
```

## When do changes take effect?

New variables and changed values take effect on the **next deployment**. An app that's already running keeps its current variables until you deploy again.

If you've just changed a variable and want it to apply now, trigger a fresh deployment:

```sh
dina deploy --app my-app --wait
```

## What about the values themselves?

Setting a variable replaces any previous value for that key. Other variables on the app are untouched — `env set` only writes the keys you name.

## Handling secrets safely

A few habits that save you from awkward accidents:

- **Don't paste secrets into chat tools or agent prompts.** Set them from a local terminal you trust.
- **Don't commit them to your repo.** That's why they're environment variables.
- **Rotate anything that's been exposed.** If you suspect a key has leaked, generate a new one with whichever service owns it, set the new value, and redeploy.

## Appendix: what `env set` doesn't do yet

The current CLI only exposes `env set`. We're adding `env list` and `env unset` soon. Until then, `dina apps info --app my-app` shows you which variables are configured on the active deployment, and you can "unset" a variable by setting it to an empty value and redeploying.