Environment variables
Configure secrets and settings per environment.
Environment variables are encrypted at rest and injected into both the build and the running app. Each variable targets production, preview, or all environments. A preview variable can also be scoped to one git branch.
In the dashboard
Open the project's Settings → Environment Variables. To add many at once, paste the contents of a .env file into a key field: each line becomes its own row. You can also import a .env file.
With the CLI
clouzark env ls
clouzark env add DATABASE_URL "postgres://..." -t production
clouzark env add API_KEY # prompts for the value
clouzark env rm API_KEY -t preview
clouzark env pull # writes .env.local with the preview values
clouzark env pull .env.production -e production-t (--target) takes all, production, or preview.
Per-branch variables
A preview variable can apply to one branch only, for example a separate test database for dev:
clouzark env add DATABASE_URL "postgres://...test..." -t preview --branch dev
clouzark env ls # the BRANCH column shows the scope
clouzark env rm DATABASE_URL -t preview --branch dev
clouzark env pull -e preview --branch devIn the dashboard, pick Preview only and enter the branch. Leave it blank for every branch.
When the same key is set more than once, the most specific value wins:
- Preview, for this branch
- Preview, for every branch
- All environments
- The linked database's values
Branch names match exactly, including case. Production never uses branch-scoped variables.
Changes apply to the next deployment. Run clouzark redeploy to rebuild the latest deployment with the new values.
Never commit .env files. clouzark deploy --upload skips them on purpose.
Linked database
Link one of the team's databases to the app and its connection details are added to every build and deployment automatically, kept up to date with the database's password and keys:
| Variable | Value |
|---|---|
DATABASE_URL | Connection string through the connection pooler (direct when the pooler isn't available) |
DIRECT_DATABASE_URL | Direct connection string, for migrations and session features |
CLOUZARK_PROJECT_URL, NEXT_PUBLIC_CLOUZARK_PROJECT_URL | The database's base URL for supabase-js |
CLOUZARK_ANON_KEY, NEXT_PUBLIC_CLOUZARK_ANON_KEY | Anon key, safe in the browser |
CLOUZARK_SERVICE_KEY | Service key, server-side only (no NEXT_PUBLIC_ variant) |
Link it under Settings → Environment Variables → Database, or:
clouzark projects database link --db <database ref> # or the database linked to this directory
clouzark projects database # show the link
clouzark projects database unlinkclouzark init offers to link them when the directory has both. A variable you set yourself with the same name is used instead. Linking or unlinking applies from the next deployment. Resetting the database password or rotating its service key redeploys linked apps automatically, since their running deployments stop working with the old values. clouzark env pull includes the linked values, so local development gets them too.