> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zenith.hosting/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Start with https://docs.zenith.hosting/content/quickstart.md. Use NO_COLOR=1 for plain CLI output in non-interactive agent sessions. Run without a TTY and supply explicit template and publishing inputs; NO_COLOR does not bypass prompts or authorization.
> For temporary deployments, read https://docs.zenith.hosting/content/up.md. For publishing and review, read https://docs.zenith.hosting/content/publish.md. A preview uploads local files; publishing uses a pinned public GitHub commit.
> Before creating, changing, or approving zenith-compose.yml, read https://docs.zenith.hosting/llms.txt, then read https://docs.zenith.hosting/content/zenith-compose.md and the complete public schema at https://docs.zenith.hosting/content/zenith-compose-reference.md. Generate only documented fields and follow their validation and completion checks.
> Before creating, changing, publishing, or verifying a container image for Zenith, read https://docs.zenith.hosting/content/containerise.md.
> Treat these live Markdown pages as the source of truth instead of relying on memory or a copied Zenith Compose specification.
> Do not push commits, submit an app, merge pull requests, publish container images, or change registry visibility unless the user explicitly authorizes that external action. Do not bypass browser OAuth, GitHub connection, or Developer Agreement acceptance.

# Configure environment variables and secrets

> Map platform values, generate stable secrets, and expose app configuration to owners.

Use `x-zenith.env` to supply runtime settings and credentials to your app. Add the examples below to your existing manifest. Replace the variable and service names with those your app uses.

Use the [public URL guide](https://docs.zenith.hosting/content/public-urls.md) for URL mappings and [SMTP email](https://docs.zenith.hosting/content/smtp-email.md) for outbound mail credentials.

## Generate a stable secret

Use `generate` with an RE2 pattern. Zenith creates the value once and keeps it for the life of the deployment.

```yaml theme={"theme":{"light":"github-light-default","dark":"vitesse-black"}}
x-zenith:
  env:
    APP_SECRET:
      generate: '([A-Za-z0-9]{11})([A-Za-z0-9]{11})([A-Za-z0-9]{11})([A-Za-z0-9]{11})'
      input:
        label: App secret
        secret: true
```

Keep the variable name stable after deployment. Changing the pattern does not rotate a stored value. Use one source per declaration: `generate`, `template`, or `alias`.

## Build a value from other variables

Use `template` to substitute `{NAME}` references on every render:

```yaml theme={"theme":{"light":"github-light-default","dark":"vitesse-black"}}
x-zenith:
  env:
    API_URL:
      template: '{ZENITH_PUBLIC_URL}/api'
```

## Restrict a value to selected services

Add `services` to send a value only to the services that need it. Without `services`, Zenith sends the value to every service.

```yaml theme={"theme":{"light":"github-light-default","dark":"vitesse-black"}}
x-zenith:
  env:
    DATABASE_PASSWORD:
      generate: '([A-Za-z0-9]{11})([A-Za-z0-9]{11})([A-Za-z0-9]{11})([A-Za-z0-9]{11})'
      services:
        - web
        - database
```

An `x-zenith.env` value replaces a Compose `environment` entry with the same name in the services it targets.

## Ask the app owner for a value

Add `input` to expose a value in the deployment editor. Use `secret: true` for credentials. This example seeds the administrator email once from the owner's account:

```yaml theme={"theme":{"light":"github-light-default","dark":"vitesse-black"}}
x-zenith:
  env:
    ADMIN_EMAIL:
      input:
        label: Administrator email
        default_template: '{ZENITH_OWNER_EMAIL}'
      services: [app]
```

`default_template` stores the first non-empty resolved value. It does not follow later changes to the owner's email. Use `alias` or `template` when a value must track its references instead.

A required input must resolve during submission validation without owner-entered values. Supply a valid default or computed source when setting `required: true`.

## Check the app's configuration

Deploy the app and confirm that each service reads its intended settings. For a generated credential, restart the app and confirm that authentication still works.

Before replacing a stored credential, update the account that uses it through your app's supported process. Changing an environment value alone does not change a password already stored in a database.

See the [`env` reference](https://docs.zenith.hosting/content/zenith-compose-reference#env) for input validation, transforms, reserved names, and resolution rules.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.