Environment Variables

An environment variable is a key-value pair your app reads at build or run time. It keeps secrets and config out of your code, so the same code works across different environments. For example:

• DATABASE_URL — where your database lives.
• API_KEY — a secret for a third-party service.
• VITE_API_URL — the backend URL your frontend talks to.

Add them when you create a service, or anytime after:

• Go to your service's Environment tab.
• Add each variable as a key and value.
• Save — Riven encrypts every value before storing it.

Your variables are encrypted at rest and only decrypted when your app builds or runs. Nobody can read them back from the dashboard once saved.

This is the one thing worth understanding, because it trips people up. There are two moments a variable can be used:

• Build time — while your app is being compiled. The value gets baked into the built output. Changing it later means rebuilding.
• Runtime — while your app is running. The value is read live from the environment each time your app starts.

Most backend variables (database URLs, secret keys) are runtime — your server reads them when it starts. But frontend variables are different, and that's where people get caught out.

Frontend variables are used at build time — they get baked into your JavaScript bundle when the app is built. This is how Vite, Next.js, and Create React App work by design.

Riven treats these prefixes as build-time variables automatically:

• VITE_ — for Vite apps.
• NEXT_PUBLIC_ — for Next.js.
• REACT_APP_ — for Create React App.

One consequence worth knowing: anything with these prefixes ends up visible in your frontend code that ships to the browser. Never put a real secret in a VITE_ or NEXT_PUBLIC_ variable — those are public by design. Keep secrets on your backend.

Mark a variable as secret to hide its value in the dashboard. Secret values show as masked dots after saving — you can update them, but you won't see the old value again. This protects keys and passwords from being read off your screen.

Whether secret or not, every value is encrypted the same way at rest. "Secret" only controls whether the value is hidden in the UI.

Already have a .env file? Instead of adding variables one by one, use Import .env on the Environment tab. Paste your file's contents and Riven adds each variable at once. Existing variables aren't overwritten unless a key matches.

After adding or changing variables, your app needs to pick them up:

• Frontend (build-time) variables — need a redeploy, since they're baked in during the build.
• Backend (runtime) variables — also take effect on the next deploy, when your app restarts and reads them fresh.

Either way, redeploy after changing variables. Riven prompts you to redeploy right after you save.