Environment Variables

Setting Variables

const api = new alien.Worker("api")
  .environment({
    LOG_LEVEL: "info",
    API_ENDPOINT: "https://api.example.com",
  })
  .build()

These are available as regular environment variables at runtime.

Secrets

Credentials like API keys and database passwords are stored in the cloud's vault service (SSM, Secret Manager, Key Vault) — never in logs or config files. They're configured per-deployment when onboarding customers, not in alien.ts.

Alien syncs per-deployment secret environment variables into an internal vault named secrets. That vault is reserved for Alien-managed deployment secrets. For customer-owned secrets that should never be visible to the management identity, declare and link your own Vault resource, then have the customer create secrets directly in their cloud vault service.

For secrets your app manages at runtime, use a Vault resource.

Per-Deployment Overrides

Different customers often need different values. Set them when creating the deployment:

alien deployments create --name acme-prod --project my-project \
  --deployment-group acme --platform aws \
  --env LOG_LEVEL=warn --secret STRIPE_KEY=sk_live_...

--env-targeted and --secret-targeted (KEY=VALUE:pattern1,pattern2) scope a variable to specific workers.

Built-In Variables

Alien injects automatically:

The ALIEN_*_BINDING variables are how your code discovers resources. See Accessing Resources.