Environment variables

Why env vars matter

An environment variable is a named value that exists in the runtime environment of your app — separate from its source code. When your app needs an API key, a database connection string, or a third-party webhook secret, it reads that value from the environment at startup rather than finding it hardcoded in a file.

This separation matters for two reasons. First, secrets that live in code end up in version control. A single accidental push to a public GitHub repository can expose credentials to the entire internet, and rotation after an exposure is painful. Second, different environments — development on your laptop, staging for QA, production for real users — need different values for the same variable. Environment variables make that switch trivial.

Setting variables in Myndlab

Every Myndlab project has an Environment panel where you define your variables. To access it:

Dev vs production values

Myndlab maintains separate variable stores for Development and Production environments. This lets you use a test Stripe key and a local database URL during development, while your production environment uses live credentials and your cloud database — without any code changes.

When Myndlab pushes a deploy to Vercel or Railway, it injects the Production variables directly into the hosting platform's secret store via their APIs. You never need to copy-paste credentials into a hosting dashboard manually.

Referencing vars in generated code

Myndlab generates code that reads environment variables using each language's idiomatic pattern. Here are the two most common cases:

In a FastAPI (Python) backend, variables are loaded with the standard library:

import os
from fastapi import FastAPI

app = FastAPI()

# Loaded from the environment at startup — never hardcoded
DATABASE_URL = os.environ.get("DATABASE_URL")
STRIPE_SECRET_KEY = os.environ.get("STRIPE_SECRET_KEY")
OPENAI_API_KEY = os.environ.get("OPENAI_API_KEY")

if not DATABASE_URL:
    raise RuntimeError(
        "DATABASE_URL environment variable is not set. "
        "Add it in Project Settings > Environment."
    )

@app.get("/health")
def health():
    return {"status": "ok"}

In a React frontend (Vite), variables must be prefixed with VITE_ to be exposed to the browser bundle. This prefix is a security measure — variables without it are never included in the client-side code, even if they exist in the environment.

// Vite exposes only VITE_-prefixed variables to the browser
const apiBaseUrl = import.meta.env.VITE_API_BASE_URL;
const stripePublicKey = import.meta.env.VITE_STRIPE_PUBLISHABLE_KEY;

// Never put secrets in VITE_ variables — they're visible in the browser
// Use VITE_ only for public, non-sensitive configuration

if (!apiBaseUrl) {
  console.error(
    "VITE_API_BASE_URL is not set. " +
    "Check Project Settings > Environment."
  );
}

In an Express (Node.js) backend, the pattern is similar to Python but uses process.env:

import express from "express";

const app = express();

const DATABASE_URL = process.env.DATABASE_URL;
const JWT_SECRET = process.env.JWT_SECRET;

if (!DATABASE_URL || !JWT_SECRET) {
  throw new Error(
    "Required environment variables are missing. " +
    "Check Project Settings > Environment."
  );
}

app.listen(process.env.PORT ?? 3001, () => {
  console.log("Server started");
});

Syncing to GitHub

When Myndlab syncs your project to GitHub, environment variables are handled carefully to prevent accidental exposure:

# .env.example — committed to GitHub (no real values)
DATABASE_URL=
STRIPE_SECRET_KEY=
STRIPE_PUBLISHABLE_KEY=
OPENAI_API_KEY=
JWT_SECRET=
APP_URL=http://localhost:3000

# .env — local only, never committed (in .gitignore)
DATABASE_URL=postgresql://postgres:password@localhost:5432/myapp_dev
STRIPE_SECRET_KEY=sk_test_...
STRIPE_PUBLISHABLE_KEY=pk_test_...
OPENAI_API_KEY=sk-...
JWT_SECRET=a-long-random-string-here
APP_URL=http://localhost:3000

Rotating a secret

Secret rotation — replacing a compromised or expired credential with a new one — should be done carefully to avoid downtime. Here is the safe sequence to follow in Myndlab: