typebase-io-cli env
Manage environment variables on your deployment provider.
Last updated on
Manage environment variables on your deployment provider.
This command talks to your provider and nothing else. It does not edit typebase/env.ts, and it does not touch your local .env. Uploading a value
is not the same as declaring it: a key the server can read is not automatically a key on the env action context.
Getting a variable into your handlers is two independent steps:
- Declare it in
typebase/env.tswithdefineEnv. This is what puts it onenvin your actions, types it, and makes the server validate it at boot. - Set its value with
env <target> add, once per target. This is what makes the value exist where the deployed server runs.
Skipping step 1 means the value is set on the provider but only reachable through process.env, untyped and unvalidated (and on Cloudflare Workers, where configuration comes from the Worker's bindings, not reliably even there). Skipping step 2 means the deployed server refuses to boot, telling you which key is missing.
DATABASE_URL and BETTER_AUTH_SECRET are exempt from both: deploy sets their values for you, and they're added to env automatically when your project has a database or auth.
env <target> get <key>
Get an environment variable from your deployment provider.
npx typebase-io-cli env dev get DATABASE_URLnpx typebase-io-cli env prod get BETTER_AUTH_SECRETenv <target> add <key> <value>
Set an environment variable on the provider, for that target only. Each target holds its own value, so a key you want in both has to be added twice.
npx typebase-io-cli env dev add MY_API_KEY sk-123456npx typebase-io-cli env prod add MY_API_KEY sk-789012A running server keeps the values it booted with. On Vercel and Deno Deploy the new value is picked up by your next deploy; on Cloudflare the secret is applied to the live Worker right away.
The command writes to the provider project the CLI has on record, so it needs one to exist. On a brand-new project, run deploy first (that's what
creates the project and saves its ID to typebase.json), then add your variables and deploy again.
Options
| Flag | Description | Default |
|---|---|---|
--provider <provider> | Deployment provider: vercel, cloudflare, or deno | From typebase.json |
--no-encrypted | Store the value unencrypted (encrypted is the default) | Off |
Secret handling differs by provider, and env get does not always return the raw value.
On Vercel, values are stored as encrypted env vars unless you pass --no-encrypted, and env get can return the stored value.
On Cloudflare, Typebase currently stores values as Worker secrets, so env get returns ENCRYPTED instead of the raw secret value.
On Deno Deploy, values are marked as secrets unless you pass --no-encrypted. Non-secret values can be returned by env get, but secret
values may come back as ENCRYPTED.
If env get prints ENCRYPTED, the provider is hiding the raw secret. In that case, manage or inspect the variable in your provider dashboard
or go back to the original source you used when setting it.
Examples
Add an encrypted variable:
npx typebase-io-cli env dev add SECRET_KEY my-secretAdd a non-encrypted variable:
npx typebase-io-cli env dev add PUBLIC_URL https://example.com --no-encryptedGet a variable:
npx typebase-io-cli env dev get SECRET_KEY