# Environment variables

How the variables of an environment are kept in your own Secret Manager, and how to read and change them.


The environment variables of an environment are kept in the Secret Manager of your own Scaleway project. Brewless keeps their names and their revisions, never a value. When you ask to see or change the values, Brewless reads or writes them in your Secret Manager with the connection it already has and passes them on. They are not stored and not logged, and that someone looked at them is written to the audit trail.

## From the command line

Fetch the variables of an environment into a file:

```bash
brewless env:pull production
```

This writes `.env.production`, with a first line that notes the revision you pulled. Change it and push it back:

```bash
brewless env:push production
```

Both commands go through Brewless, so your machine needs no Scaleway key.

| Option | What it does |
| --- | --- |
| `--file=` | Another file than `.env.<environment>` |
| `--force` | On `env:push`: push without asking, also over a revision you did not pull |
| `--direct` | Read or write the variables in your Secret Manager straight from your machine, with a Scaleway key of your own. The values do not pass through Brewless |

> [!NOTE]
> `env:push` replaces the variables of the environment with the contents of the file, comments included. If someone else saved after your last pull, the push is refused before it overwrites their revision. Variables the push would remove are named, and the client asks before it removes them.

With `--direct` the client takes the key from `SCW_SECRET_KEY`, or from the active profile of Scaleway's own client (`scw init`). The key needs to read and write Secret Manager in your project.

## From the console

Under **Variables** on the page of an environment you see the names, and you can set or remove a single variable.

**Show values** reads every variable from your Secret Manager as one dotenv file, which you can edit and save as a new revision. Saving replaces all variables with the file. When someone saved in between, saving is refused; load the newest revision and make your change again.

A value you set or save there passes through Brewless on its way to your Secret Manager. It is not stored and not logged. To keep values away from Brewless altogether, use `brewless env:push --direct`.

## From brewless.yml

Plain values, such as a locale or a log level, can live in your `brewless.yml` under `variables`. A deploy writes them into a new revision before the build, next to the variables that are there. A name that looks like a secret is refused in the file: secrets stay with `env:push`. See [brewless.yml](/reference/brewless-yml).

A variable the file gives is marked **Set in brewless.yml** in the console. Changing or removing it here, or with a file that changes it, is refused: the next deploy would put the file's value back. Change it in the file and deploy.

## When a change takes effect

Variables reach the containers with the next deploy. Until then the console shows that the newest revision is not live yet.

## Names

A name starts with a letter or an underscore and holds only letters, digits and underscores. A value has at most 16,000 characters.