Environment Variables & Secrets

DeployOS has two layers of environment variables, plus an optional third layer for teams that already run a secrets manager.

Per-app environment variables

Set on an app's Config tab (or in the New App form). These are written to a .env file on the server at deploy time and are specific to that one app.

Per-app values are stored in your OS keychain, not in the plaintext app config on disk — the config file DeployOS keeps for each app never contains secret values, only which keys exist.

Enlarge

Global secrets

Go to Secrets to manage key/value pairs shared across every app you deploy — API keys, a shared database URL, anything you don't want to copy into each app individually. Global secrets are merged into every deploy's .env automatically; if an app defines the same key itself, the app's own value wins.

This is the "Local" secret provider and is always available, with values stored in your OS keychain.

External secret providers

If your team already keeps secrets in a dedicated manager, connect it from Settings → Secret Provider:

• HashiCorp Vault (KV v2)
• Infisical
• Doppler
• 1Password Connect

Once connected, secrets fetched from the provider are merged in alongside your global secrets — local values still take precedence, so you can override a provider value per-machine without touching the shared vault.

Precedence, summarized

1. Per-app environment variable (highest priority)
2. Local global secret
3. External provider secret (lowest priority)

💡 Tip — if a deployed app can't see a variable you're sure you set, check the Config tab's env list first; adopted apps in particular start with an empty per-app env because DeployOS didn't create their original container. See Adopting an Existing Server.