Environment variables

Save API keys, database URLs, and other settings once, and every agent you start gets them automatically.

#Add variables

Manage your variables in either place:

• Settings → Environment Variables, in the Personal .env card, or
• inside a workspace, Settings → Environment variables (owners and editors).

Then:

• Add variable: enter a Name and Value, then Save variable. Names are converted to upper case as you type.
• Import .env: paste the contents of a .env file or upload one. Turn on Overwrite existing variables to replace values you already have.
• Import from Vercel: enter a Vercel access token, an optional team, the project, and the environment (Development, Preview, or Production). CoDev doesn't keep the Vercel token, and skips variables Vercel marks as sensitive.

To change a value, replace it; to remove one, choose Delete variable.

#All workspaces or one

Each variable applies to All workspaces or to one workspace you pick from the Workspace menu. If both exist with the same name, the workspace's own value wins.

#Where they show up

• Agents: every agent turn you start gets your variables. Agents are told the variable names, never the values.
• Terminals don't get them. Everyone with editor access runs terminals as the same user on the workspace machine, so editors can read the environment of your terminals. If you set a value in a terminal yourself, editors can read it while that terminal runs.
• Your provider sign-in always wins. If you've connected Claude, Codex, or Cursor, a variable with the same name doesn't replace that sign-in.
• On CoDev credits, variables whose names start with ANTHROPIC_, CLAUDE_CODE_, OPENAI_, or CODEX_ aren't passed to the agent.

#Privacy

• Values are encrypted when saved and are write-only: after you save a value, CoDev only shows its last four characters.
• For agent turns, values go into a private agent profile on the workspace machine that other members can't read. CoDev never writes them to the workspace's files.

#Limits

Only upper-case names (like DATABASE_URL) reach agents. Others are saved but marked Agents only get uppercase names.