Env vars

Last updated 05 November 2026

Env vars are the settings an app gets, like DATABASE_URL. dudbox keeps them encrypted. A secret value is write-only: the app gets it, but no answer shows it again (value is null), and build logs mask it. The one exception is a one-click app's login password (login.password_env on the service), which you type into the app.

The app gets a change on its next deploy: after you set or delete env vars, call POST .../redeploy once (see Deployments).

The examples use API=https://dudbox.com/api/v1 and AUTH="Authorization: Bearer $DUDBOX_TOKEN".

GET /api/v1/services/{project}/{service}/env

All env vars of a service. Secret values are null here.

{
  "env": [
    { "key": "LOG_LEVEL", "value": "info", "secret": false },
    { "key": "DATABASE_URL", "value": null, "secret": true }
  ]
}

GET /api/v1/services/{project}/{service}/env/{key}

One env var. A secret value is null, except a one-click app's login password: dudbox logs each read of that, with the token that read it.

curl -s $API/services/acme/shop/env/LOG_LEVEL -H "$AUTH"

{ "key": "LOG_LEVEL", "value": "info", "secret": false }

PUT /api/v1/services/{project}/{service}/env/{key}

Makes or changes an env var. secret is false if you leave it out. A name has letters, digits and _, and does not start with a digit. A value is at most 32 KB.

curl -s -X PUT $API/services/acme/shop/env/DATABASE_URL -H "$AUTH" -H 'content-type: application/json' \
  -d '{"value": "postgres://…", "secret": true}'

Answer: 200 with the env var (value is null for a secret).

POST /api/v1/services/{project}/{service}/connect

Gives a database to an app: sets the database's connect URL (DATABASE_URL or REDIS_URL), with its password, on an app in the same project, as a secret. {service} is the database. The password never leaves dudbox. The app gets the URL on its next deploy: call POST .../redeploy on the app.

curl -s -X POST $API/services/acme/postgres/connect -H "$AUTH" -H 'content-type: application/json' \
  -d '{"app": "shop"}'

{ "key": "DATABASE_URL", "value": null, "secret": true }

A {service} that is not a database gets 400. An app that is not in the project gets 404.

DELETE /api/v1/services/{project}/{service}/env/{key}

Deletes an env var. Answer: 204, no body. A name that is not there gets 404.