// ENVIRONMENT AND SECRETS
Environment Variables
System vs. user variables, the key format, and how values reach your running container.
Environment variables are set per project and split into two kinds:
| Kind | Who sets it | Editable? |
|---|---|---|
| System | AnySites (DATABASE_URL, PORT) | No — read-only, shown masked (first 20 characters) in the dashboard. |
| User | You | Yes — set, update, or delete freely. |
Keys must match ^[A-Z_][A-Z0-9_]*$ — uppercase letters, digits, and underscores, not starting with a digit. Values are stored AES-256-GCM encrypted and only decrypted server-side when injected into a build or a running container; the dashboard never displays a saved user variable's value back to you (it shows ***), so keep your own record of anything you'll need again.
How they reach your app
Every variable (system and user) is passed to the container as a standard Docker environment variable at deploy time, and also passed as a Docker build-arg during the image build. Read them with process.env / os.environ / whatever your language's standard mechanism is — no special integration needed.
Manual Deployments.