Variables and secrets

Your keys and passwords are kept encrypted by while, never in the code or in while.yaml. They reach your app at the next deployment.

Updated November 9, 2026.

You, to your agent: Add the variable LOG_LEVEL=info.

What your agent writes

Your agent writes it in while.yaml, at the root of your app:

while.yaml

services:
  - name: web
    port: 3000
    env:
      MODE: demo
      STRIPE_KEY: { secret: payment/key }
      API_KEY: { secret: api/key, file: true }

When to use it

For every key and every password: never in while.yaml, never in the code.

How it works

Your keys and passwords are set with set_env, or referenced in while.yaml, and while keeps them encrypted in its vault. They reach the app at the next deployment, as a variable or as a file in /run/secrets/<NAME>.

What to know

A secret set as a file (file: true) never arrives as a variable. The app reads it in /run/secrets/<NAME> (in Node with readFile, in Python with Path.read_text, in Go with os.ReadFile), removing the final line break if there is one. The variables that while sets itself, such as DATABASE_URL or the connections’ addresses, keep their name.

In a project linked to a federated connection whose “approve each production deployment” box is checked, a secret never arrives as an environment variable: set_env and the production deployment refuse it, and it is set as a file. In this project, the variables are all in clear text, and shown to the person who approves.

Your agent’s MCP tools

Your agent handles it with the set_env tool.

Guides

Your app’s environment variables and secrets, out of the code, with your AI agent