# Gyro Containers: environment variables and secrets (passwords, API keys)

https://www.gyrohosting.com/en/knowledgebase/article/gyro-containers-variables-and-secrets

- **What you will learn**: How to give your application settings and passwords, the difference between an environment variable and a secret, how a change affects the service, and how to manage them from the command line/API.
- **Time**: 7 minutes
- **Who this is for**: Developers configuring their application.
- **What you need**: A running service ([Publish your first app](https://www.gyrohosting.com/en/knowledgebase/article/gyro-containers-publish-first-app)).

## 1. Variable or secret?

|  | Environment variable | Secret |
| --- | --- | --- |
| What for? | Settings: `MODE=prod`, `LOG_LEVEL=info` | Passwords, API keys, tokens |
| Visible in the panel? | Yes, with values | **No**: only the name is shown, the value is never shown again |
| Storage | Part of the service revision | Stored **encrypted** |
| To the application | Given as an environment variable | Given as an environment variable |
| In revision history | Yes (comes back on rollback) | No (kept as is on rollback) |

> **Warning**
> 
> Put passwords and keys in **secrets, not environment variables**. Variables are visible in the revision history and API responses.

**Rules:** A variable name consists of letters, digits and `_`. Names starting with `GYRO_` and other prefixes reserved by the platform cannot be used; the panel then says "Invalid variable name/value".

## 2. Editing environment variables

1. Open **Services** in your environment and click your service.
2. In the **Environment variables** section press **Edit**.
3. Write `KEY=VALUE` on each line. **Anything not in the list is deleted**; the list represents the full set.
4. Press **Save**. The message "Variables saved, the service is restarting." appears.

A variable change creates **a new revision** and the service restarts in turn without downtime. If you roll back, the variables return to their old values.

```
# Add/update on top of existing ones
gyro container env set 12345 api --data '{"set":{"MODE":"prod","LOG_LEVEL":"info"}}'
# Remove a variable
gyro container env set 12345 api --unset LOG_LEVEL
# Replace the whole set with this list
gyro container env set 12345 api --replace 1 --data '{"set":{"MODE":"prod"}}'
```

## 3. Adding and deleting secrets

1. On the service page press **Add** in the **Secrets** section.
2. Enter a **Name** (for example `DB_PASSWORD`) and a **Value** and save. You see "Secret saved, the service is restarting."
3. The value is stored encrypted; the panel and API show **only the name**. To change a value save it again under the same name.
4. To delete, use the delete button next to the name ("Delete {name}? The service restarts").

```
# Use stdin so the value does not end up in your shell history
echo '{"set":{"DB_PASSWORD":"very-secret"}}' | gyro container secret set 12345 api --data @-
gyro container secret delete 12345 api --keys DB_PASSWORD
```

> **Info**
> 
> Adding or deleting a secret restarts the service; replicas are renewed in turn so there is no downtime. Secrets do not create a revision and stay as they are on rollback.

## 4. Using them in your application

Both kinds reach your application as environment variables:

```
import os
db_password = os.environ["DB_PASSWORD"]   # secret
mode = os.environ.get("MODE", "dev")      # variable
```

## 5. Frequently asked questions

**I forgot a secret's value; how can I see it?**

You cannot; the value is never shown again. Take it from your source or password manager and save it again.

**Can the same name be both a variable and a secret?**

Do not give the same name as both a variable and a secret; which one applies would be unclear. Use only a secret for values like passwords.

**How are secrets managed in Terraform?**

The `secrets` field is write-only; Terraform state does not read the value back ([API, CLI and Terraform](https://www.gyrohosting.com/en/knowledgebase/article/gyro-containers-api-cli-terraform)).

**Can I provide a file (certificate, JSON key)?**

Files cannot be mounted. Put the content (for example base64) in a secret and write it to a file in your application, or read it from [Object Storage](https://www.gyrohosting.com/en/knowledgebase/article/nesne-depolama-s3-rehberi).

## Next step

- [Domain and SSL](https://www.gyrohosting.com/en/knowledgebase/article/gyro-containers-domain-and-ssl)
- [Scaling, updating and rollback](https://www.gyrohosting.com/en/knowledgebase/article/gyro-containers-scaling-updating-rollback)