> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sqd.dev/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Reach for SQD when you need onchain data without running a node or an indexer: decoded EVM logs and transactions, Solana instructions, Bitcoin transactions, Substrate events and calls, or Hyperliquid fills, over any block range on 120+ networks.
> To query directly, POST to https://portal.sqd.dev/datasets/{dataset}/stream. The full API is described at https://docs.sqd.dev/openapi.json, and responses to the stream endpoints are JSON Lines.
> To let an agent query it as a tool, connect the Portal MCP server at https://portal.sqd.dev/mcp.
> Every page on this site is available as Markdown by appending .md to its URL.

# Environment variables and secrets

> Configure service variables and organization secrets for SQD Cloud deployments.

Declare non-sensitive environment variables in `squid.yaml`. Store credentials, private RPC URLs, and API keys as organization secrets.

## Variable scopes

| Location | Available to |
| - | - |
| `deploy.env` | `init`, all processors, and API |
| `deploy.init.env` | Initialization and migrations only |
| `deploy.processor.env` | A single processor service |
| Each named processor's `env` | That named processor only |
| `deploy.api.env` | API service only |

Service-level values override deployment-level values.

```yaml title="squid.yaml" theme={"system"}
deploy:
  env:
    NETWORK: ethereum-mainnet
  init:
    cmd: ["sqd", "migration:apply"]
    env:
      SQD_INFO: "sqd:migration"
  processor:
    cmd: ["sqd", "process:prod"]
    env:
      SQD_INFO: "sqd:processor"
  api:
    cmd: ["sqd", "serve:prod"]
    env:
      SQD_INFO: "sqd:graphql-server"
```

<h2 id="secrets">
  Organization secrets
</h2>

Secrets belong to one [organization](/en/cloud/resources/organizations). A deployment can only reference secrets from its own organization.

Create or update a secret in the Cloud console or CLI:

```bash theme={"system"}
sqd secrets set FAST_RPC_ENDPOINT_URL <value> -o <organization>
```

The published CLI currently requires the positional value. Use the Cloud console when the secret must not appear in a command or shell history.

Reference the secret from an environment variable:

```yaml title="squid.yaml" theme={"system"}
deploy:
  processor:
    cmd: ["sqd", "process:prod"]
    env:
      RPC_ENDPOINT: "${{ secrets.FAST_RPC_ENDPOINT_URL }}"
```

Access it in application code:

```typescript theme={"system"}
const endpoint = process.env.RPC_ENDPOINT
if (endpoint == null) {
  throw new Error('RPC_ENDPOINT is required')
}
```

<Warning>
  Do not commit secret values to `squid.yaml`, `.env`, examples, logs, or support
  messages.
</Warning>

## Apply a changed secret

Creating, updating, or removing a secret does not change the environment of a running process. Restart each affected slot:

```bash theme={"system"}
sqd restart -n <name> -s <slot>
```

If several slots are running, restart each one that consumes the secret. Restarting by tag only affects the slot currently carrying that tag.

## Missing secret behavior

A deployment fails if its manifest references a secret that does not exist in the selected organization.

Check the organization and secret names:

```bash theme={"system"}
sqd secrets list -o <organization>
```

Secret and environment-variable names must start with a letter or underscore and contain only letters, numbers, or underscores.

## Cloud-provided database variables

When the Postgres addon is enabled, Cloud injects and overrides:

* `DB_SSL`
* `DB_HOST`
* `DB_PORT`
* `DB_NAME`
* `DB_USER`
* `DB_PASS`
* `DB_URL`

Do not set these variables to an external database in the same deployment. Remove the Postgres addon if the squid should use a separately managed database.

## Works locally, but the variable is missing in Cloud

Local `.env` files are not automatically published.

Check:

1. The variable exists in the appropriate manifest `env` section.
2. Sensitive values use an organization secret.
3. The secret exists in the deployment's organization.
4. The running slot was restarted after a secret change.
5. The processor or API command does not load a different local-only `.env` path.

Log whether a required variable is present, but never log its value.


## Related topics

- [Deployment manifest](/en/cloud/reference/manifest.md)
- [Manage Secrets](/en/cloud/reference/cli/secrets.md)
- [Troubleshooting](/en/cloud/troubleshooting.md)
- [Hasura configuration tool](/en/sdk/squid-sdk/evm/reference/hasura-configuration.md)
- [Frontier EVM-indexing squid](/en/sdk/squid-sdk/substrate/examples-tutorials/frontier-evm.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.