Environment

Pull variables into .env.local, and add a secret from stdin so it stays out of shell history.

bash

stechbd env pull
cat key.pem | stechbd env add SIGNING_KEY --secret

env pull writes every value to .env.local, or to the file you name, readable only by you. It refuses to replace an existing file without --force, before the panel is asked, because the read is audited.

env add reads a value from stdin, so a value piped in, such as cat key.pem, stays out of shell history.

Scope is kept in section headers: a build only variable under the runtime only header is invisible to a build, and the error that produces names something else entirely.

Warning

A value that contains $ is written literally, which is what dotenv, Node's --env-file and Docker Compose read. Next.js and Vite expand it, so a$b reaches them as a. No spelling is right for both, so each such variable is named in a warning with the remedy.