> ## Documentation Index
> Fetch the complete documentation index at: https://docs.attio.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Environment Variables

> App-level secrets and configuration for your server-side code

Environment variables let you supply app-level secrets and configuration, such as an API key for a
vendor account owned by your app, to your app's server-side code. They are read via `process.env`
and are available in server functions, webhook handlers, event handlers, and
[workflow block](../workflows/file-structure) handlers.

<Note>
  Environment variables are app-level: every execution of your app's server-side code sees the same
  values. To authenticate individual Attio users or workspaces to an external service, use
  [connections](../guides/authenticating-to-external-services) instead.
</Note>

## Reading variables

Read variables with `process.env`, exactly as you would in Node.js:

```ts send-message.server.ts theme={"system"}
export default async function sendMessage(text: string) {
  const response = await fetch("https://api.example.com/v1/messages", {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      Authorization: `Bearer ${process.env.EXAMPLE_API_KEY}`,
    },
    body: JSON.stringify({text}),
  })

  if (!response.ok) {
    throw new Error(`Failed to send message: ${await response.text()}`)
  }
}
```

* Values are typed `string | undefined`.
* Reading a variable that is not set returns `undefined` and logs a warning. You can find the
  warning in the Logs tab for your app in the [developer dashboard](https://build.attio.com), or
  stream it to your terminal with the CLI. See [Debugging your app](../guides/debugging-your-app)
  for both options.
* The server runtime is not Node.js, and only `process.env` is supported. Accessing any other
  property of `process` (`process.cwd`, `process.versions`, etc.) throws an error. Assignments to
  `process.env` are silently ignored.

<Warning>
  `process` does not exist in client-side code. TypeScript cannot scope the global `process`
  declaration to server files, so client-side code that accesses `process` will type-check but
  throw a `ReferenceError` at runtime.
</Warning>

## Development

In development, define variables in a `.env` file in your project root, using the standard
[dotenv](https://github.com/motdotla/dotenv) format:

```bash .env theme={"system"}
EXAMPLE_API_KEY=sk_test_123
```

You can also create a `.env.local` file, commonly used for values specific to your machine. Both
files are optional, and when the same key appears in both, the `.env.local` value wins.

The development server reads both files and uploads the variables with your development version.
The files are watched, so changes apply without a restart.

## Production

Environment variables for the production version of your app are managed in the **Secrets** tab of
your app's settings in the [developer dashboard](https://build.attio.com), separately from
development.

* Values are write-only: once saved, a value is never displayed again. Saving a key that already
  exists overwrites its value.
* Only admins of the developer account can create, overwrite, or delete variables. All members can
  see which keys exist and when they were last set.
* Changes apply from the next execution of your server-side code. You do not need to publish a new
  version of your app.

## Limits and validation

| Limit                 | Value                                                                                    |
| --------------------- | ---------------------------------------------------------------------------------------- |
| Number of variables   | 100                                                                                      |
| Key format            | Uppercase letters, digits, and underscores, starting with a letter (`^[A-Z][A-Z0-9_]*$`) |
| Key length            | 256 bytes                                                                                |
| Value size            | 64 KiB                                                                                   |
| Reserved key prefixes | `ATTIO_` and `__ATTIO`                                                                   |

Violations are reported as errors by the development server and when saving variables in the
developer dashboard.

## Security

* Values are encrypted at rest and decrypted only when your server-side code is invoked.
* Values are write-only: no API or UI returns a value after it has been set.
* Environment variables are only injected into the server runtime and are never part of your app's
  client bundle.