---
title: "Environment variables"
description: "Give your services API keys, database URLs and other settings, stored encrypted."
canonical_url: "https://harblet.com/docs/deploy/environment-variables"
---
# Environment variables

> Give your services API keys, database URLs and other settings, stored encrypted.

Environment variables give a service its API keys, database URLs and other settings. Image and Git services have them. Databases don't, since Harblet configures them for you.

## Add variables

<steps level="3">

### Open the tab

Open the service and go to **Environment variables**.

### Add a row per variable

Click **Add variable** and enter a key and a value.

- **Keys** use letters, digits and underscores, don't start with a digit and have at most 253 characters, for example `DATABASE_URL`. Each key can be used once.
- **Values** can't be empty, hold up to 32,768 characters and can span several lines, for example for a PEM key.

### Save and deploy

Click **Save**, then click **Deploy**. Variables apply on the next deployment.

</steps>

Saved values are hidden. Click the eye button to show a value, and the trash button to remove a variable. **Save** stores the list as you see it, so removed rows are deleted.

## Where variables reach

- **The running service** reads them as environment variables.
- **Builds of Git services** get them as well. See [Variables during the build](https://harblet.com/docs/deploy/git-repositories#variables-during-the-build).

Each deployment keeps the variables it was deployed with. [Redeploying](https://harblet.com/docs/deploy/deployments#redeploy-an-earlier-deployment) an earlier deployment brings back its variables too.

## Connect to other services

Use the [internal address](https://harblet.com/docs/deploy/projects-and-services#connect-services-to-each-other) of another service in the project. For a database, copy the **Connection URL** from its **Overview** tab. See [Databases](https://harblet.com/docs/deploy/databases).

```bash
DATABASE_URL=postgresql://postgres:<password>@postgresql-x7k2:5432/app
REDIS_URL=redis://cache-p4n1:6379
```

## Security

- Harblet stores values **encrypted** in its database, with a key derived from its app secret.
- **Every member** of your Harblet can see and change the variables of every service.
- References such as `$OTHER_KEY` aren't expanded. Each value reaches the service exactly as you entered it.

<warning>

Restoring Harblet from a backup needs the app secret, or the variables can't be decrypted. See [Backing up Harblet](https://harblet.com/docs/backups/harblet-backups).

</warning>


## Sitemap

See the full [sitemap](https://harblet.com/sitemap.md) for all pages.