---
title: "Environment variables and secrets: the while.sh docs"
url: https://while.sh/en/docs/building-blocks/secrets/
updated: 2026-11-09
---

# Variables and secrets

Your keys and passwords are kept encrypted by while, never in the code or in while.yaml. They reach your app at the next deployment.

> You, to your agent: Add the variable LOG_LEVEL=info.

## What your agent writes

Your agent writes it in while.yaml, at the root of your app:

```yaml titre="while.yaml"
services:
  - name: web
    port: 3000
    env:
      MODE: demo
      STRIPE_KEY: { secret: payment/key }
      API_KEY: { secret: api/key, file: true }
```

## When to use it

For every key and every password: never in while.yaml, never in the code.

## How it works

Your keys and passwords are set with `set_env`, or referenced in while.yaml, and while keeps them encrypted in its vault. They reach the app at the next deployment, as a variable or as a file in `/run/secrets/<NAME>`.

## What to know

A secret set as a file (`file: true`) never arrives as a variable. The app reads it in `/run/secrets/<NAME>` (in Node with readFile, in Python with `Path.read_text`, in Go with `os.ReadFile`), removing the final line break if there is one. The variables that while sets itself, such as `DATABASE_URL` or the connections' addresses, keep their name.

In a project linked to a federated connection whose "approve each production deployment" box is checked, a secret never arrives as an environment variable: `set_env` and the production deployment refuse it, and it is set as a file. In this project, the variables are all in clear text, and shown to the person who approves.

## Your agent's MCP tools

Your agent handles it with the `set_env` tool.

## Guides

- [Your app's environment variables and secrets, out of the code, with your AI agent](/en/guides/environment-variables-secrets/)