Env vars

Last updated 05 November 2026

Env vars are the settings your app reads when it starts, like DATABASE_URL or API_KEY. dudbox keeps them encrypted.

Add or change one

1. Open the app, then the Env tab.
2. Type the name and the value, then click Add. A name has letters, digits and _, and does not start with a digit.
3. Click Redeploy now in the bar that shows up. The app gets env vars only when it starts, so a change waits for the next deploy.

Paste a .env file

Copy your whole .env file and paste it into the name or the value field. dudbox shows the names it found. Pick Secret or not, then click Add. A name that is there already gets the new value. Lines that start with # are skipped.

Secrets

A secret's value is write-only. Your app gets it, but nobody can read it on the dashboard or through the API again, not even you. Build logs mask it. This way a stolen login or API token cannot read your keys and passwords.

• Secret is on when you add a value. Turn it off for settings that are not secret, like LOG_LEVEL.
• To change a secret, click the edit button and set a new value.
• To make a plain value secret, click the lock button. There is no way back, except to set a new value.
• When you import a repo, env vars from a pasted .env file are saved as secrets.
• A one-click app's admin password is the one secret you can still see: click Show. You type it into the app to log in.

Keep your own copy of a secret, in a password manager, if you will need it again.

Set by dudbox

• PORT: the port your app must listen on.
• One-click apps get their own env vars, such as the admin password. Leave those as they are, unless you know the app.

The API can read and set env vars too. See Env vars in the API.