---
title: Variables
description: Set service and shared variables, reference one service's values from another, keep secrets sealed, and read the variables Dekka provides.
section: Services
order: 6
---

Variables reach a service as environment variables when it starts. Each service has its own, each environment has shared variables its services can draw on, and Dekka adds a few of its own. Open a project's **Environment** tab and choose a service, or **Shared**, to manage them.

## Add a variable

Type a name and value and choose **Add**. Changes collect in a bar at the bottom of the page until you choose **Save**, which keeps them for the service's next deploy or restart, or **Save and restart**, which applies them now. Names use letters, numbers and underscores and can't start with a number.

Values are encrypted at rest. A variable whose name contains `SECRET`, `TOKEN`, `PASSWORD` or `KEY` is stored as a secret, so its value is hidden in the dashboard and kept out of logs. To see a secret, press and hold it, and each reveal is recorded in your organisation's **Activity**.

```bash tab="cURL"
curl -X PUT https://api.dekka.cloud/v1/resources/$SERVICE_ID/env \
  -H "Authorization: Bearer $DEKKA_API_KEY" \
  --json '{ "vars": [ { "key": "STRIPE_SECRET_KEY", "value": "sk_live_…", "secret": true } ] }'
```

`PUT` creates or updates the variables you send and leaves the rest alone. In the API, `secret` defaults to `true`.

## Seal a secret

Turn on **Seal** before choosing **Add**, or send `"sealed": true`, and the value can never be shown again, even to you. The service still receives it. Sealing is permanent, so to change a sealed value you overwrite it with a new one.

## Share a variable between services

Shared variables belong to an environment rather than a service, and a service only receives one when it references it. Choose **Shared** on the **Environment** tab to add them, and use one in a service's variable as `${{shared.NAME}}`.

```bash title=".env"
SENTRY_DSN=${{shared.SENTRY_DSN}}
```

## Reference another service's variable

A value can include `${{service.KEY}}`, where `service` is the name of another service in the same environment. Dekka fills in the value each time the service deploys or restarts, so it stays current when the other service changes.

```bash title=".env"
API_URL=https://${{api.DEKKA_PUBLIC_DOMAIN}}
API_INTERNAL_URL=http://${{api.DEKKA_PRIVATE_DOMAIN}}:${{api.PORT}}
DATABASE_URL=${{api.DATABASE_URL}}
```

Dekka checks every reference when you save and refuses names that don't exist with 422 `unknown_reference`, listing each bad reference. Referenced values can contain references of their own, up to ten levels deep. If a reference stops resolving later, or two values refer to each other, the next deploy or restart fails and says which reference broke. Renaming a service updates the references that point at it.

## Which variables does Dekka set?

Dekka sets these on every service, marked **Dekka** in the list. You can't edit them, but a variable of your own with the same name takes their place.

- `PORT` is the service's port, such as `3000`, on web services.
- `DEKKA_PRIVATE_DOMAIN` is the service's [private hostname](/docs/private-networking), such as `api.production.dekka.internal`.
- `DEKKA_PUBLIC_DOMAIN` is a web service's `apps.dekka.cloud` address, such as `api-x2k4.apps.dekka.cloud`, while its public address is on.
- `DEKKA_ENVIRONMENT` is the environment's name, such as `production`.

Connecting a service to a database or bucket adds the [connection's variables](/docs/connections#which-variables-does-a-connection-set), marked **Connection**. They are secret and read-only, and disconnecting removes them.

## Edit variables as a .env file

Choose **Raw .env** under **Editor** to edit every variable as text. Comments, quotes and `export` are accepted. Secret, sealed and connection values aren't shown in the text and are kept as they are, and new variables added this way aren't secret. Tick **Delete variables that aren't in the text** to remove anything you've deleted from the text, apart from sealed and connection variables.