Variables

Variables are environment variables for a service's process: database URLs, API keys, feature switches. Each service has its own set in each environment.

#Edit variables

Open a service and go to Variables.

• Add variable adds one name and value.
• Raw editor shows every variable as a .env file. Paste a file to replace them all at once.

DATABASE_URL=postgresql://app:secret@postgres.mesh.internal:5432/app
STRIPE_SECRET_KEY=sk_live_...
LOG_LEVEL=info

Variables are part of the service draft, so changes are staged. Release the environment to restart the service with the new values. See Deployments and releases.

#Who can see values

Every value is treated as a secret. Values are encrypted at rest and never appear in deployment diffs or debug output.

Through the API, service reads return names with empty values. Pass include_secrets=true with a full-access token whose owner may read values to see them. The MCP server's list_variables tool returns names only unless the agent asks for values.

#Connect services

Mesh has no reference syntax between services. To point a service at a database, copy the database's connection values into the service, using its internal hostname:

DATABASE_URL=postgresql://app:<password>@postgres.mesh.internal:5432/app

Database templates generate credentials and set DATABASE_URL, REDIS_URL, and similar variables on the database service itself; copy the one you need. See Private networking.

#Build time

Variables are runtime configuration. They are not passed into builds. If your build needs a value, commit a non-secret default or read it when the process starts.