Same agent.
Different environment.
Staging, production, dev. Each with its own variables, connector wiring, and optional budget limits. The agent spec stays the same; the world it runs in changes.
Read the environments docsEnvironment variables
- DATABASE_URLpostgres://••••@db.connic.co/prod
- STRIPE_SECRET_KEYsk_live_••••••••••••••••••
- OPENAI_API_KEYsk-••••••••••••••••••••••
- SENTRY_DSNhttps://••••@o123.sentry.io/4501
- AWS_S3_BUCKETconnic-prod-uploads
- WEBHOOK_SIGNING_SECRETwhsec_••••••••••••••••••
The same agent, in every environment
The agent file is identical across environments. Variables, connector wiring, and budget limits differ. They're scoped per environment, never hard-coded.
Mark as sensitive, masked in the dashboard and logs
Per-environment variables are injected into your agent containers at deploy time. Mark a variable as sensitive and the value is hidden in the dashboard after creation, and masked in logs.
Variables are stored encrypted and only injected into your agent containers at deploy time.
Mark a variable as Sensitive and the value is masked in the dashboard (shown as ••••••••) once saved.
Sensitive values are masked in logs. Changes to variables require a redeployment to take effect. See the variables docs.
mcp_servers:
- name: research-hub
url: https://mcp.example.com/research
headers:
Authorization: "Bearer ${RESEARCH_TOKEN}"
tools:
- search_papers
- fetch_abstractIn agent YAML, reference variables with ${VAR_NAME} wherever the schema accepts a string: MCP server headers, custom LLM provider URLs, and similar config fields. In Python tools and middleware, read them via os.environ. Values resolve at deploy time to whatever the active environment has bound.
Git branch mapping does the routing
Iterate locally with connic dev; pushing to develop deploys to staging; merging to main deploys to production. Each environment is mapped to a branch, and Connic deploys on push.
Why not just .env files?
What separates Connic environments from the patterns most teams outgrow
| Feature | Connic | .env files | HashiCorp Vault | Doppler |
|---|---|---|---|---|
| Per-environment scoping | Included | Partial | Included | Included |
| Stored encrypted | Included | Not included | Included | Included |
| Sensitive values masked in logs | Included | Not included | Included | Included |
| Project audit log | Included | Not included | Included | Partial |
| Git branch → environment mapping | Included | Not included | Not included | Not included |
| Wired to connectors | Included | Not included | Not included | Not included |
| Wired to agent specs | Included | Not included | Not included | Not included |
| Per-environment budget limits | Included | Not included | Not included | Not included |
| No extra service to operate | Included | Included | Not included | Not included |