Environment Variables

Environment variables let you supply app-level secrets and configuration, such as an API key for a vendor account owned by your app, to your app’s server-side code. They are read via process.env and are available in server functions, webhook handlers, event handlers, and workflow block handlers.

Environment variables are app-level: every execution of your app’s server-side code sees the same values. To authenticate individual Attio users or workspaces to an external service, use connections instead.

Reading variables

Read variables with process.env, exactly as you would in Node.js:

send-message.server.ts

export default async function sendMessage(text: string) {
  const response = await fetch("https://api.example.com/v1/messages", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Bearer ${process.env.EXAMPLE_API_KEY}`,
    },
    body: JSON.stringify({text}),
  })

  if (!response.ok) {
    throw new Error(`Failed to send message: ${await response.text()}`)
  }
}

Values are typed string | undefined.
Reading a variable that is not set returns undefined and logs a warning. You can find the warning in the Logs tab for your app in the developer dashboard, or stream it to your terminal with the CLI. See Debugging your app for both options.
The server runtime is not Node.js, and only process.env is supported. Accessing any other property of process (process.cwd, process.versions, etc.) throws an error. Assignments to process.env are silently ignored.

process does not exist in client-side code. TypeScript cannot scope the global process declaration to server files, so client-side code that accesses process will type-check but throw a ReferenceError at runtime.

Development

In development, define variables in a .env file in your project root, using the standard dotenv format:

.env

EXAMPLE_API_KEY=sk_test_123

You can also create a .env.local file, commonly used for values specific to your machine. Both files are optional, and when the same key appears in both, the .env.local value wins. The development server reads both files and uploads the variables with your development version. The files are watched, so changes apply without a restart.

Production

Environment variables for the production version of your app are managed in the Secrets tab of your app’s settings in the developer dashboard, separately from development.

Values are write-only: once saved, a value is never displayed again. Saving a key that already exists overwrites its value.
Only admins of the developer account can create, overwrite, or delete variables. All members can see which keys exist and when they were last set.
Changes apply from the next execution of your server-side code. You do not need to publish a new version of your app.

Limits and validation

Limit	Value
Number of variables	100
Key format	Uppercase letters, digits, and underscores, starting with a letter (`^[A-Z][A-Z0-9_]*$`)
Key length	256 bytes
Value size	64 KiB
Reserved key prefixes	`ATTIO_` and `__ATTIO`

Violations are reported as errors by the development server and when saving variables in the developer dashboard.

Security

Values are encrypted at rest and decrypted only when your server-side code is invoked.
Values are write-only: no API or UI returns a value after it has been set.
Environment variables are only injected into the server runtime and are never part of your app’s client bundle.

Introduction

Guides

Extensions

Workflow blocks

Notifications

Dialogs

Components

Forms

Icons

Settings

GraphQL

Data fetching

Server

System

Legacy

Environment Variables

Reading variables

Development

Production

Limits and validation

Security

​Reading variables

​Development

​Production

​Limits and validation

​Security

Reading variables

Development

Production

Limits and validation

Security