Secrets & Environment Variables

Environment Variables

Manage environment variables in the Environment tab:

• Add variables for Dev and Prod separately
• Variables are injected into your backend at runtime
• Never hardcoded in source code

Secret Detection

Airbuild automatically detects when you paste secrets (API keys, passwords, tokens) into the chat:

• A banner appears with the value masked and a suggested variable name
• You can save the value to .env or dismiss the banner — nothing in the message is masked, and the message is not held back
• Detected patterns: API keys, passwords, tokens, connection strings

Best Practices

• Never hardcode secrets — Use environment variables instead
• Use different keys for Dev and Prod — Separate API keys for each environment
• Tell the AI about your env vars: "Use the STRIPE_API_KEY environment variable for payments"
• Don't paste full connection strings in chat — Add them in the Environment tab instead

How the AI Uses Env Vars

When you ask the AI to integrate an external service, it is instructed to:

• Create an environment variable for the API key
• Reference it via process.env (frontend) or os.getenv (backend)
• Never hardcode the actual value

If a key ends up in the code anyway, the secret scan that runs before publishing blocks the release.

Integration-Managed Variables

Some environment variables are managed by integrations (e.g., DATABASE_URL from PostgreSQL). These are marked as read-only and cannot be edited manually.