ezforge env - ezForge AI

Environment variables are stored encrypted (AES-256-GCM) and injected into your server’s microVM at runtime. They are never logged or exposed.

ezforge env set

Set one or more environment variables.

ezforge env set <server-name> KEY=value [KEY2=value2 ...]

Examples:

ezforge env set my-server OPENAI_API_KEY=sk-...
ezforge env set my-server DATABASE_URL=postgres://... LOG_LEVEL=info

Changes take effect on the next deployment.

ezforge env list

List environment variable names (values are never shown).

ezforge env list <server-name>

Output:

KEY              SET AT
OPENAI_API_KEY   2026-01-15 10:00 UTC
DATABASE_URL     2026-01-15 10:01 UTC
LOG_LEVEL        2026-01-15 10:01 UTC

ezforge env unset

Remove an environment variable.

ezforge env unset <server-name> KEY [KEY2 ...]

Example:

ezforge env unset my-server LOG_LEVEL

Changes take effect on the next deployment.

Reserved names

A few names are reserved for platform-injected configuration (AUTO_STOP_SECONDS, HEALTH_CHECK_PATH, HEALTH_CHECK_TIMEOUT_SECONDS, SERVER_SUBDOMAIN, OAUTH_BASE_URL, EZFORGE_MCP_PUBLIC_URL, FLY_MCP_REPLAY_TOKEN) and cannot be overridden. ezforge env set on one of these names succeeds, but the platform value is used at deploy time — see Reserved variable names.

Security notes

Values are write-only via the API — once set, a value can never be read back, only overwritten or deleted
Variables are encrypted at rest using AES-256-GCM; the encryption key is unique per server
Decryption happens only inside the server’s Firecracker microVM, just before process startup
Variables are isolated per server — one server cannot read another’s variables

​ezforge env set

​ezforge env list

​ezforge env unset

​Reserved names

​Security notes

ezforge env set

ezforge env list

ezforge env unset

Reserved names

Security notes