The Environments tab holds each environment’s configuration and secrets. Config is layered — an environment’s override wins over the project default — and saving applies to the running app in about ten seconds, without a rebuild or a deploy.
Secrets are write-only
You can set a secret and you can overwrite it, but you can never read one back: the dashboard shows which keys are set, never their values, and the API never returns them.
Secrets you give Weaveflow are encrypted with a key scoped to your organization.
Local development
Generate for this env bakes the environment’s values into a gitignored
.env file for the checkout, so local runs see the same configuration the
box does — without those values ever living in the repository.
What goes where
- Config — feature flags, URLs, tuning values. Safe to read, differs per environment.
- Secrets — API keys, database credentials, anything you would rotate if it leaked.
When the agent needs credentials at run time — like your Anthropic key — they are injected into its container for the run and never written to the box’s disk.