Give a Project Variables

TL;DR

Create an Environment in Settings, add its plain and secret Variables, then pin it to a Project. New Runs receive the values as process environment variables, while the agent's prompt lists only their names and kinds.

An Environment is a named set of Variables that one or more Projects can use. A Variable is plain when its value should remain readable in the Dashboard, or secret when it must become write-only after you save it.

Create an Environment

1. Open Settings in your Dashboard (#/settings).
2. Find Environments and enter a name under New Environment, such as acme-staging.
3. Select Create. Zozo opens the empty Environment so you can add its first Variable.

Recreate instead of renaming

You can't rename an Environment. Create one with the new name, move each Project's pin to it, then delete the old one.

Add Plain and Secret Variables

Use a plain Variable for a value such as a feature flag or public service URL:

1. Under Add Variable, enter a POSIX-safe Key, such as API_BASE_URL.
2. Enter the Value and choose Plain as the Kind.
3. Select Add Variable.

Use the same form for an API key, token, or other sensitive value, but choose Secret as the Kind. After saving, Zozo shows the secret's name, kind, and update time, but never reads its value back. You can overwrite or delete a secret later. A plain Variable can be converted to secret, but a secret can't be converted back to plain.

Configure private reach explicitly

Private reach comes only from a Tailnet Key in the pinned Environment, never from a Variable's URL. Tools must use the Cell's SOCKS5 proxy. Follow Let Runs Reach Your Tailnet to configure it.

Pin the Environment to a Project

1. Open Projects in your Dashboard (#/projects).
2. Find the Project and choose the Environment from its Environment menu.
3. Wait for the saved state to appear. The next Run started for that Project resolves the current pin and receives the latest Variable values. A Run that's already in flight keeps the values it started with.

Choose None from the same menu to remove the pin. Zozo refuses to delete an Environment while any Project pins it and names the Projects you must update first.

What the Agent Sees

Every Run for the pinned Project, including Dispatch, Intake Sessions, Clarifications, Wayfinder, and Steer work, receives the Variables in its process environment. Code can read them through its ordinary runtime mechanism, such as process.env.API_BASE_URL in Node.js or os.environ["API_BASE_URL"] in Python.

The task prompt includes an Environment section that lists each Variable's name and whether it's plain or secret. It doesn't put values in the prompt. Zozo also replaces exact secret values in Event text before writing the Event journal, but this redaction is best-effort rather than a security guarantee. Values shorter than eight characters aren't redacted, and an encoded, split, or otherwise transformed secret may not match the saved value.

Related

• Data & Privacy explains where Environments live, how they're protected, and why backups and exports exclude them.
• Watch a Project covers the rest of a Project's configuration.
• Guide the Agent From Your Repo covers durable repository instructions that belong in version control instead of an Environment.