Environment variables

Environment variables are set per project under Settings → Variables. They are available to the install and build commands and to the running application.

Names and values

Names may contain letters, digits and underscores and must not start with a digit. Maximum 200 characters.
Values may be up to 65,536 characters. Multi-line values, such as PEM keys, are fine.
There is no limit on the number of variables.

Encrypted, and never shown again

Values are encrypted before they are stored and are never returned by the API or the dashboard. The variables list shows names and last-updated times only. If you need to check a value, set it again.

When changes take effect

Variables are packaged into a deployment when it is created. Adding, changing or deleting a variable does not touch the app that is currently running. Trigger a new deployment, from the dashboard, the CLI, or a push to the default branch, for the change to apply.

Build time and runtime

The same set of variables is present in both places:

During the build, they are exported into the shell before the install and build commands run. Framework conventions apply, so a Next.js NEXT_PUBLIC_ variable is inlined into the client bundle at this point.
At runtime, they are injected into the container as ordinary environment variables.

Names to avoid

Vinssi does not reject any name, but a few collide with the platform:

PORT is always set to 3000 at runtime. A value you set is ignored.
PATH, HOME, NPM_CONFIG_PREFIX and COREPACK_HOME are used by the build environment. Overriding them will break the install or build step.

Databases

The simplest option is a managed database. Add one under Settings → Database and Vinssi injects DATABASE_URL into every build and deployment itself; it appears in the variables list as a read-only row. Because a managed DATABASE_URL overrides a variable of the same name that you defined, delete your own DATABASE_URL once the managed one is running to avoid confusion. The page warns you while both exist.

To bring your own database instead, use a PostgreSQL or similar service that is reachable over the public internet, and set its connection string as DATABASE_URL or whatever your app expects. Connections from Vinssi come from changing addresses, so rely on TLS and a strong password rather than an IP allowlist. Most providers require TLS; include sslmode=require in a PostgreSQL URL if your client does not default to it.

Managing variables from the CLI

The CLI does not manage variables yet. Use the dashboard.

Locked while deletion is scheduled

Variables become read-only when a project is scheduled for deletion. Cancel the deletion to edit them.

Audit trail

Setting or deleting a variable is recorded in the project's Activity tab by name. Values are never written to the audit log.