Editing project secrets, API keys, and env vars in Environment

Software → Environment is a per-project editor for your secrets, API keys, and environment variables. It's where you store the credentials a project needs, encrypted and scoped to that project.

What it stores

Environment holds secrets, API keys, and environment variables for the project you're in. Each entry is a name plus a value. The values are stored encrypted at rest using AES-256-GCM with a project-scoped key, so each project keeps its own isolated set.

Adding and removing

To add or update a variable, enter a name and its value and save — you'll get a confirmation that it was saved encrypted. There's a show/hide toggle on the value field while you're typing so you can check what you're entering. To remove a variable, delete it from the list. Saving a name that already exists updates that variable in place.

How values are handled

When the Environment list loads, it only ever receives masked hints (showing the last few characters), never the full values — the actual secret never comes back down to the browser after it's saved. See the related article on why values are masked for more on this.

Where it lives

This is a per-project secrets store kept in the project's own encrypted storage. It's distinct from your account-level Bring Your Own Key vault (for provider keys like OpenRouter and Composio) and from your Connections — use Environment for the secrets a specific project needs.