Environment variables, kept out of your code

Store tokens, passwords and connection strings in each application's settings. Values stay masked on screen, a .env comes in with one paste, and a restart applies the change without a new upload.

Get started nowAPI reference
Up to 256 variables per application, on every plan. Also through the CLI and the API.

How it works

Variables belong to the application, not to the files you upload. Change one and the next start picks it up.

  1. 1

    Add or paste

    Type a key and its value, paste KEY=value lines into a key field, or import a .env file.

  2. 2

    Save

    One save sends the whole list. Values the shell would split or expand are quoted on the way.

  3. 3

    Restart

    Right after saving, the dashboard offers to restart. The application starts with the new values, with no new upload.

Secrets stay hidden on screen

The editor in your application's settings masks every value until you ask for it and keeps related keys together.

  • Masked values

    Values show as dots. Reveal one with the eye, copy it without revealing it, or click it to edit.

    • Each edit is confirmed or canceled on its own
    • Hold Shift to remove a row in one click

  • Grouped by prefix

    Keys that share a prefix, such as DB_HOST and DB_USER, are listed together, in alphabetical order.

    • Search by key once the list passes 15
    • A warning shows when few slots are left

  • Square Cloud defaults

    HOST, PORT and SQUARECLOUD_APP_ID come with every application, shown read-only with a note on what each is for.

    • HOST 0.0.0.0 and PORT 80 for HTTP
    • The application's own ID at runtime
  • Up to 256 variables per application
  • Keys up to 1,024 characters, values up to 4,096
  • In a workspace, only admins open the editor
  • Included on every plan

Bring the .env you already have

Import a .env file and review it before anything changes: new keys, keys that would be replaced and lines that can't come in, each with its line number and the reason.

  • Paste whole lines

    Paste several KEY=value lines into a key field and each one becomes a row. A key you already have takes the pasted value.

    • Comments and the export prefix are handled
    • Pasting into a filled row keeps that variable

  • Set them while deploying

    The deploy form takes variables too, and when your project has a .env.example it offers those keys for you to fill in.

    • Also reads .env.sample, .env.template and .env.dist
    • Leaves HOST and PORT to Square Cloud

  • Export or copy

    Download every variable as a KEY=VALUE text file, or copy them all, to move them to another application.

    • Values come out quoted, ready to load
    • Rows without a key are left out

Values reach your code as you typed them

Your application loads its variables through a shell, where a space, a $ or a ; can cut a value short or change it. The editor quotes those values for you.

  • Quoted where needed

    A value with spaces or characters such as $, &, ;, | or ) goes in single quotes when you confirm it, import it or save.

  • Risky quotes refused

    Double quotes around a value with $ would let the shell expand it, so the editor asks you to remove them or use single quotes.

  • Keys kept valid

    Spaces in a key become underscores, and a key can't appear twice. In an import, a key must start with a letter or _.

From the terminal and the API

The same variables are reachable from the CLI, the GitHub Action, the VS Code extension and the REST API.

Square Cloud CLI
squarecloud app env set DB_HOST=10.0.0.4 "GREETING=hi there"squarecloud app env set --from-file .envsquarecloud app env list

Since version 3.1.1, the CLI quotes values with spaces or symbols for you. See everything the CLI does.

REST API
curl -X POST "https://api.squarecloud.app/v2/apps/$APP_ID/envs" \  -H "Authorization: $SQUARECLOUD_API_KEY" \  -H "Content-Type: application/json" \  -d '{"envs": {"NODE_ENV": "production", "LOG_LEVEL": "info"}}'curl -X POST "https://api.squarecloud.app/v2/apps/$APP_ID/restart" \  -H "Authorization: $SQUARECLOUD_API_KEY"

Send values as the shell should read them, in single quotes when they have spaces or symbols. A restart applies them.

  • GET
    /v2/apps/{appId}/envs

    List the application's environment variables.

  • POST
    /v2/apps/{appId}/envs

    Add variables or change existing ones. The rest stay as they are.

  • PUT
    /v2/apps/{appId}/envs

    Replace every variable with the ones you send.

  • DELETE
    /v2/apps/{appId}/envs

    Remove the variables you name.

  • API keys can be limited to envs:read or envs:write, and to a single application.
API reference

Questions about environment variables

What are environment variables on Square Cloud?

They are key and value pairs stored in your application's settings and loaded when it starts. They keep tokens, passwords and connection strings out of your code and out of the files you upload. Each application has its own list of up to 256 variables.

Do I need to deploy again after changing a variable?

No. Save the change and restart the application: it starts with the new values, with no new upload. Until the restart, the running process keeps the values it started with.

Which variables does Square Cloud provide?

HOST (0.0.0.0), PORT (80) and SQUARECLOUD_APP_ID, the application's own ID. They show read-only at the top of the editor. A web application that listens on that host and port is reachable over HTTP.

How do I store a value with spaces, quotes or a $?

Type it as it is. The dashboard and the CLI wrap such values in single quotes, so the shell loads them unchanged. Through the API, send them already in single quotes. Avoid double quotes around a value with $: the shell would expand it.

Can I keep a .env file in my project?

You can, but import it in the dashboard instead: the variables set there take precedence over the values in that file at runtime. To keep the file out of your uploads, list it in squarecloud.ignore, which the CLI and the VS Code extension both read.

Who can see the values?

In your account, only you. In a workspace, only members with admin permission can open the editor. An API key needs the envs:read scope, or full access, to read them.

How many variables can an application have?

Up to 256, with keys up to 1,024 characters and values up to 4,096. The editor warns you when few slots are left and won't save past the limit.

Do static sites have environment variables?

No. A static site is served as files, with no process to read them, so its settings have no variables tab. They are for applications with a runtime, such as Node.js, Python, Java, Go or Rust.

A plan for every stage of your project

Start small and scale when you need to, with no loyalty contracts.

Compare all plans

4.9 out of 5 · 402 reviews on Google + TrustpilotTrustpilot

Hosted in a partner datacenter with certifications
Tier 3ISO 27001SOC 2 Type IIAlways-On DDoS Protection
Explore our infrastructure

Ready to scale your project?

Join the 500,000+ developers who have used Square Cloud to host their projects.

Start now on Square CloudSee plans and pricing
  • Predictable pricing
  • No billing surprises
  • Deploy in seconds
  • High availability
  • Scale with stability
  • Automatic restart
  • SSL and security included
  • Isolated containers