Building

Environment variables

How .env works: the values Qyant manages, the ones you add, and what the model can and cannot see.

Updated 21 Sept 2026

Every project has a .env file at its root. Qyant generates it, keeps parts of it up to date, and keeps its secrets out of the model's view.

What Qyant manages

Two variables are written and refreshed by Qyant whenever the preview starts:

Variable	Value
`DATABASE_URL`	The connection string for the project's private Postgres database
`PORT`	The port the dev server listens on inside the sandbox

Don't edit these; they're overwritten on the next start. The header comment in the file says the same.

What you add

Everything else is yours. Add API keys and configuration the normal way:

STRIPE_SECRET_KEY=sk_live_…
NEXT_PUBLIC_APP_NAME=Acme CRM

Save the file (the editor's Save button) and restart the preview for the running app to pick the new values up. Variables prefixed NEXT_PUBLIC_ are exposed to the browser, as in any Next.js app; everything else is server-only.

What the model sees

The model needs to know which variables exist to write correct code, but it must never see secret values. So:

Variable names are visible to the model.
The values of managed secrets (DATABASE_URL) are shown to it as <managed-by-qyant>.
When the model proposes a change to .env (adding a new variable, say), the real values are restored before the file is written on accept.

The model can — and often will — add variables it needs. For example, if you ask for email sending it may add RESEND_API_KEY= to .env and tell you to fill it in.

GitHub and deployments

.env is never pushed to GitHub and never baked into a deployment image. Deployments receive their configuration as container environment variables at start: DATABASE_URL is injected automatically; variables you added in .env are carried over from the project so the deployed app behaves like the preview. Rotate a secret by editing .env and redeploying.

Reading variables in code

Standard Next.js:

// server code only
const key = process.env.STRIPE_SECRET_KEY;

// available in the browser too
const name = process.env.NEXT_PUBLIC_APP_NAME;