Skip to Content
TestingApp Environment Variables

App Environment Variables

OpenFactory can store app-scoped and account-scoped environment values, encrypt them at rest, and render them into a candidate app VM during deploy. This is an early file-backed secret store, not a managed vault.

Scope and precedence

  • Account values are reusable defaults for every app owned by that account.
  • App values override account values with the same name.
  • Managed values are written by a configured producer token and record the producer that owns the key.
  • A changed value increments env_version; a successful deploy records the applied version. A difference means a redeploy is required.

Names must be uppercase environment identifiers, are limited to 128 characters, and cannot use the reserved OPENFACTORY_ prefix. User values are limited to 8 KiB and an app is limited to 100 keys.

MCP workflow

List operations always mask values. Reveal one value only when necessary:

set_app_env(
  app_id="550e8400-e29b-41d4-a716-446655440000",
  set={"API_BASE_URL": "https://api.example.internal"}
)

list_app_env(app_id="550e8400-e29b-41d4-a716-446655440000")

reveal_app_env(
  app_id="550e8400-e29b-41d4-a716-446655440000",
  name="API_BASE_URL"
)

The same pattern is available as set_account_env, list_account_env, and reveal_account_env. App-level set/delete operations return an env_version and a redeploy_hint; setting a value does not mutate a running VM.

REST surface

MethodPathPurpose
GET/api/apps/{app_id}/envMasked app-key list and version state
PUT/api/apps/{app_id}/envTransactional set/delete for app keys
POST/api/apps/{app_id}/env/revealAudited plaintext reveal of one app key
GET/api/account/envMasked account-key list
PUT/api/account/envTransactional set/delete for account keys
POST/api/account/env/revealAudited plaintext reveal of one account key
PUT/api/apps/{app_id}/env/managedConfigured producer publishes managed keys
DELETE/api/apps/{app_id}/env/managed/{name}Producer removes a managed key it owns

User surfaces enforce the resolved owner context. Managed endpoints use a <kid>.<secret> bearer credential from the operator-configured producer-token file; without that file the producer API returns unavailable.

Deploy behavior

During deploy, the backend decrypts account values, overlays app values, adds the platform’s runtime fields, and writes /etc/openfactory/app.env in the VM with mode 0600. The process is started with that file as its environment. If decryption, file delivery, or startup fails, the candidate is not promoted.

Security boundary

  • Stored values use Fernet encryption. The operator must supply and protect OPENFACTORY_ENV_MASTER_KEY; losing or replacing it makes existing values undecryptable.
  • List responses are masked. Explicit reveals and mutations append a JSONL audit event.
  • The current storage and audit trail are local files. They do not provide hardware-backed keys, multi-party approval, tamper-evident logging, automatic rotation, or a disaster-recovery guarantee.
  • Application and deploy logs do not yet provide a complete secret-redaction boundary. A process that prints its environment, a credential-bearing URL, or a secret in an error can expose it in logs and test evidence.

For that reason, do not use this preview store for production credentials until your deployment has independent access controls, backup and restore tests, log-redaction validation, retention rules, and a documented key-rotation procedure. Never place secrets in recipes, source code, commands, URLs, test descriptions, or assertion expectations.

See App deployment for the candidate promotion flow.

Custom app domainsApp observability