Can I put my secrets in while.yaml?

Not secrets: while.yaml describes the app, and secrets live in while’s vault. A variable that holds no secret, yes.

What about the .env file in my repository?

It stays out of the build and the image: its values are set in while.

Do I need to redeploy after a change?

Yes: a changed variable reaches your app at the next deployment.

Environment variables and secrets, with while.sh

A key in the code or in a .env file ends up leaking. On while, your AI agent sets your app’s variables over MCP, and your secrets live in an encrypted vault: your app receives them, and your agent cannot read them back.

Prerequisites

An app deployed on while, or ready to be.
Your AI agent, connected to while over MCP.

Step 1: Ask your agent for a variable

You, to your agent: Add the variable LOG_LEVEL=info.

Your agent sets it over MCP, and it reaches your app at the next deployment.

Step 2: Keep your secrets to yourself

For a key or a password, paste the value yourself into your app’s settings in while, under “Variables and secrets”: your app receives it, and your agent never sees it. And when your agent sets a secret over MCP, it can no longer read it back.

What your agent does

Secrets live in an encrypted vault, never in while.yaml or in your code, as the Twelve-Factor App method recommends¹. A variable that holds no secret can be written in while.yaml. They reach your app at every deployment, as environment variables, or as files in /run/secrets/ for the most sensitive ones:

server.js

import { readFile } from 'node:fs/promises';

const cle = (await readFile('/run/secrets/CLE_API', 'utf8')).trim();

Use a private npm registry

You, to your agent: Our private npm registry requires a token.

Your agent declares a build secret, NPM_TOKEN, and a .npmrc that reads it. You enter its value: it is used to install the packages, never by your app, and it doesn’t stay in the image.

while.yaml

services:
  - name: web
    port: 3000
    build:
      secrets: [NPM_TOKEN]

Use a different value in preview

You, to your agent: Set LOG_LEVEL=debug in preview.

Each environment has its own variables: the preview says more in its logs, and production stays quiet.

The addresses your app receives automatically

You, to your agent: Which variables does our app receive?

Your agent lists them for you: DATABASE_URL for the database, REDIS_URL for the cache, the S3_ variables for storage, SENTRY_DSN for errors, and one address per connected API.

Go back to the previous version

You, to your agent: Go back to the previous version.

In the 30 minutes after a deployment, the previous version comes back in a second. After that, it takes a few seconds. Once the previous version is back, your agent reads what broke in while’s logs, fixes it and deploys again.

In the docs: Variables and secrets, Previews, Versions and rollback and Errors (Sentry).

Your app’s environment variables and secrets, out of the code, with your AI agent