env

Values are encrypted at rest. A new key is stored as a secret, which floo never returns, unless its name starts with NEXT_PUBLIC_, VITE_, or REACT_APP_, or you pass --config. Build-time prefixes default to readable config; deploys receive both kinds.

set

Set an environment variable. Keys are uppercased. Pass KEY=VALUE inline, or KEY alone with --stdin or --value-file to keep the value out of argv, shell history, and ps.

floo env set LOG_LEVEL=info --config --app my-app

Flags

Flag	Description
`--app APP`	App name or UUID (reads from config if omitted)
`--service SVC`	Target specific services (repeatable or comma-separated)
`--env ENV`	Environment: `dev` (default) or `prod`
`--restart`	Redeploy dev with the new value. Dev only: combining it with `--env prod` fails, and prod picks up the change with the next prod release
`--stdin`	Read the value from stdin. One trailing newline is stripped.
`--value-file PATH`	Read the value from a file. One trailing newline is stripped.
`--secret`	Store as a secret (the default for new keys); use it to turn an existing config key into a secret
`--config`	Store as readable config, which `floo env get` returns. A secret cannot become config; unset it first.
`--preflight`	Preview the change without applying it

Examples

floo env set DATABASE_URL --stdin --secret --app my-app
floo env set STRIPE_SECRET_KEY --value-file ./stripe-key.txt --secret --app my-app
floo env set NODE_ENV=production --app my-app --restart
floo env set API_KEY --stdin --secret --app my-app --service api --service worker

JSON output

{
  "success": true,
  "data": {
    "id": "0b6f...",
    "app_id": "a1b2c3d4-...",
    "env_id": "e7f8...",
    "service_id": null,
    "key": "DATABASE_URL",
    "masked_value": "********",
    "is_secret": true,
    "created_at": "2026-03-01T14:00:00Z",
    "updated_at": "2026-03-01T14:00:00Z"
  }
}

With more than one --service, data is {"results": [...]}, one entry per target. With --restart, data is {"env": ..., "deploy": ...}.

get

Get a config variable’s plaintext value. Secrets cannot be read back (ENV_VAR_WRITE_ONLY); overwrite them with floo env set. Human output refuses a secret-shaped config value unless you pass the global --reveal-secrets flag; JSON redacts it by default and sets contains_secrets: true.

floo env get PUBLIC_API_ORIGIN --app my-app
floo env get DATABASE_URL --app my-app --reveal-secrets

Flags

Flag	Description
`--app APP`	App name or UUID (reads from config if omitted)
`--service SVC`	Target a specific service
`--env ENV`	Environment: `dev` (default) or `prod`

JSON output

{
  "success": true,
  "data": {
    "key": "DATABASE_URL",
    "value": "***REDACTED***"
  },
  "contains_secrets": true
}

list

List environment variables with values masked. Without --service, lists every service’s variables plus app-level ones, with a Service column when the app has services.

floo env list --app my-app

Flags

Flag	Description
`--app APP`	App name or UUID (reads from config if omitted)
`--service SVC`	Target specific services (repeatable or comma-separated)
`--env ENV`	Environment: `dev` (default) or `prod`

JSON output

{
  "success": true,
  "data": {
    "env_vars": [
      { "key": "DATABASE_URL", "value": null, "masked_value": "********", "service_id": null, "is_secret": true },
      { "key": "STRIPE_SECRET_KEY", "value": null, "masked_value": "********", "service_id": null, "is_secret": true }
    ]
  }
}

unset

Remove an environment variable. Keys are uppercased.

floo env unset DATABASE_URL --app my-app

Flags

Flag	Description
`--app APP`	App name or UUID (reads from config if omitted)
`--service SVC`	Target specific services (repeatable or comma-separated)
`--env ENV`	Environment: `dev` (default) or `prod`
`--preflight`	Preview the removal without applying it

JSON output

{
  "success": true,
  "data": {
    "key": "DATABASE_URL"
  }
}

With more than one target, data adds removed_from.

import

Import environment variables from a .env file. FILE defaults to the env_file from config, then .env.

floo env import .env --app my-app

Flags

Flag	Description
`--app APP`	App name or UUID (reads from config if omitted)
`--service SVC`	Target specific services (repeatable or comma-separated). Cannot combine with `--all`.
`--all`	Import env vars for all services using their configured `env_file` paths. Cannot combine with `FILE` or `--service`.
`--secret`	Store every imported variable as a secret (the default for new keys)
`--config`	Store every imported variable as readable config
`--env ENV`	Environment: `dev` (default) or `prod`
`--preflight`	Preview the import without applying it

Examples

# Import from a specific .env file
floo env import .env --app my-app

# Import for specific services
floo env import .env --app my-app --service api --service worker

# Import for all services using their configured env_file paths
floo env import --all --app my-app

# Agent workflow: import and verify
floo env import .env --app my-app --json 2>/dev/null | jq '.data'

JSON output

{
  "success": true,
  "data": {
    "created": 3,
    "updated": 2,
    "skipped": [],
    "env_vars": [
      { "key": "DATABASE_URL", "masked_value": "********", "is_secret": true },
      { "key": "REDIS_URL", "masked_value": "********", "is_secret": true }
    ]
  }
}

Each env_vars entry carries the same fields as env set output. With more than one --service, data is {"results": [...]}; with --all, it is {"total_imported", "services_imported", "results"}.

Errors

Code	Meaning
`NOT_AUTHENTICATED`	Run `floo auth login` first
`APP_NOT_FOUND`	No app with that name or ID
`INVALID_FORMAT`	Missing `=` in `KEY=VALUE` argument
`ENV_VAR_WRITE_ONLY`	`floo env get` on a secret; its value is never returned
`SECRET_REVEAL_REQUIRED`	`floo env get` refused to print a secret-shaped value; re-run with `--reveal-secrets`

CLI

Config and runtime

Errors

API

set

Flags

Examples

JSON output

get

Flags

JSON output

list

Flags

JSON output

unset

Flags

JSON output

import

Flags

Examples

JSON output

Errors

​set

​Flags

​Examples

​JSON output

​get

​Flags

​JSON output

​list

​Flags

​JSON output

​unset

​Flags

​JSON output

​import

​Flags

​Examples

​JSON output

​Errors

set

Flags

Examples

JSON output

get

Flags

JSON output

list

Flags

JSON output

unset

Flags

JSON output

import

Flags

Examples

JSON output

Errors