Environment variables

Every service needs configuration that shouldn't live in your repo, API keys, database URLs, a Discord bot token. Flow gives you two places to put that, and the difference between them matters more than it might seem at first.

Project-shared versus service-specific

Open a Project and there's an Environment tab on the Project itself, separate from any individual Service. Anything you save there is available to every Service inside that Project, automatically, no copying and pasting between your bot and your site. This is exactly how an addon's connection string reaches everything that needs it, see Projects and services.

Each individual Service also has its own Environment tab, for variables that only make sense for that one thing, a DISCORD_TOKEN for your bot that the site has no business seeing, for instance. Service-specific variables sit on top of whatever the Project already shares, both apply at once.

A reasonable rule of thumb: if more than one Service in a Project would need the same value, put it on the Project. If it's specific to one Service, put it there instead.

How you actually edit them

Both tabs use the same simple editor: a single text box, one KEY=value pair per line, exactly like a .env file. Lines starting with # are treated as comments if you want to leave yourself a note about what something is for. Save with the button, or just press Cmd/Ctrl+S while you're in the box.

Saving replaces the full set for that scope: remove a line and save, and that variable is deleted, not just left blank. Everything else gets created or updated to match what's in the box. There's no separate "add one variable" flow, you're always editing the whole list at once, which in practice is faster once you're used to it, especially when you're pasting in a batch of values from somewhere else.

Encryption

Every variable you save through either editor is encrypted at rest using the APP_ENCRYPTION_KEY from your Flow installation's .env file, there's no separate toggle for "this one's a secret and this one isn't," Flow treats all of it as sensitive by default. When you reopen the editor, values are decrypted and shown to you in plain text in the box, there's no masking or a "click to reveal" step in the way, since you generally need to see what you're editing to edit it. Anyone with access to that Project or Service in Flow can see its variables, which is worth keeping in mind when you're deciding who has access to what.

Where they end up

Whatever you save gets injected into the running container or process as real environment variables at deploy time, read them the normal way for whatever language you're using, process.env.DATABASE_URL in Node, os.environ in Python, and so on. Changing a variable doesn't restart a running Service on its own, you'll want to hit Reload or Deploy afterward so the new values actually take effect, see Deploying for the difference between those two.