---
title: "Environment variables and secrets, with while.sh"
url: https://while.sh/en/guides/environment-variables-secrets/
author: "Aloïs Oddon, co-founder of Nextmap"
updated: 2026-11-02
---

# Your app's environment variables and secrets, out of the code, with your AI agent

A key in the code or in a .env file ends up leaking. On while, your AI agent sets your app's variables over MCP, and your secrets live in an encrypted vault: your app receives them, and your agent cannot read them back.

## Prerequisites

- An app deployed on while, or ready to be.
- Your AI agent, connected to while over MCP.

## Step 1: Ask your agent for a variable

> You, to your agent: Add the variable LOG_LEVEL=info.

Your agent sets it over MCP, and it reaches your app at the next deployment.

## Step 2: Keep your secrets to yourself

For a key or a password, paste the value yourself into your app's settings in while, under "Variables and secrets": your app receives it, and your agent never sees it. And when your agent sets a secret over MCP, it can no longer read it back.

## What your agent does

Secrets live in an encrypted vault, never in while.yaml or in your code, as the Twelve-Factor App method recommends (source 1). A variable that holds no secret can be written in while.yaml. They reach your app at every deployment, as environment variables, or as files in `/run/secrets/` for the most sensitive ones:

```js titre="server.js"
import { readFile } from 'node:fs/promises';

const cle = (await readFile('/run/secrets/CLE_API', 'utf8')).trim();
```

## Use a private npm registry

> You, to your agent: Our private npm registry requires a token.

Your agent declares a build secret, `NPM_TOKEN`, and a `.npmrc` that reads it. You enter its value: it is used to install the packages, never by your app, and it doesn't stay in the image.

```yaml titre="while.yaml"
services:
  - name: web
    port: 3000
    build:
      secrets: [NPM_TOKEN]
```

## Use a different value in preview

> You, to your agent: Set LOG_LEVEL=debug in preview.

Each environment has its own variables: the preview says more in its logs, and production stays quiet.

## The addresses your app receives automatically

> You, to your agent: Which variables does our app receive?

Your agent lists them for you: `DATABASE_URL` for the database, `REDIS_URL` for the cache, the `S3_` variables for storage, `SENTRY_DSN` for errors, and one address per connected API.

## Go back to the previous version

> You, to your agent: Go back to the previous version.

In the 30 minutes after a deployment, the previous version comes back in a second. After that, it takes a few seconds. Once the previous version is back, your agent reads what broke in while's logs, fixes it and deploys again.

## Next steps

- [Connect Stripe or Brevo without a key in the code](/en/guides/api-keys-out-of-code/)
- [Call Claude or GPT without exposing the key](/en/guides/call-llm-api-without-exposing-key/)
- [Security on while](/en/security/)

## Sources

1. [The Twelve-Factor App, config](https://12factor.net/fr/config), 2026-11-02

## Questions

### Can I put my secrets in while.yaml?

Not secrets: while.yaml describes the app, and secrets live in while's vault. A variable that holds no secret, yes.

### What about the .env file in my repository?

It stays out of the build and the image: its values are set in while.

### Do I need to redeploy after a change?

Yes: a changed variable reaches your app at the next deployment.