Environments

Store secrets and configuration variables in one place, available across webhook middleware, cron jobs, and MCP services. Reference them with {{env.KEY_NAME}} syntax.

How It Works

Environment variables are a centralized way to manage configuration that's shared across multiple HookWatch services. Unlike Cron Secrets which are specific to cron jobs, environment variables can be scoped to any service.

  1. Create a variable with a key, value, scope, and optional description
  2. Secret values are encrypted with AES-256; non-secret values are stored as-is
  3. Reference the variable in templates using {{env.KEY_NAME}}
  4. At runtime, variables are resolved based on the service scope

Service Scopes

Control where each variable is available by setting its scope:

ScopeAvailable In
allAll services: webhooks, cron, and MCP (default)
webhookWebhook middleware and routing rules only
cronCron jobs and cron chains only
mcpMCP server configurations only

Template Syntax

Reference environment variables using the {{env.KEY}} syntax in any supported template field:

Template

Scope Filtering

Only variables matching the current service scope (or all) are available at runtime. A variable scoped to webhook won't be resolved in a cron job.

Secret vs Plain Values

Variables can be marked as secret or plain:

TypeStorageAPI Behavior
is_secret: trueAES-256 encryptedValue never returned in API responses
is_secret: falseEncrypted (same storage)Value never returned in API responses

Security Note

All values are encrypted at rest regardless of the is_secret flag. The flag controls how the value is displayed in the dashboard (masked vs visible).

Base URL

https://api.hookwatch.dev/v1/environment

The Environment Variable Object

Values are never included in API responses. Only the key, scope, and metadata are returned.

Json

Properties

FieldTypeDescription
idstringUnique identifier
user_idstringOwner user ID
team_idstringTeam ID (if team-scoped)
keystringVariable name (unique per user, e.g., API_SECRET_KEY)
is_secretbooleanIf true, value is AES-256 encrypted at rest
scopestringWhere the variable is available: all, webhook, cron, or mcp
descriptionstringOptional human-readable description

Create Variable

Create a new environment variable.

POST /v1/environment

Request Body

FieldTypeRequiredDescription
keystringYesVariable name (must be unique per user)
valuestringYesVariable value (encrypted if is_secret is true)
is_secretbooleanNoEncrypt the value at rest (default: true)
scopestringNoService scope: all, webhook, cron, or mcp (default: all)
descriptionstringNoOptional description for the variable

Example

curl

List Variables

Retrieve all environment variables for the authenticated user.

GET /v1/environment

Response

Json

Get Variable

Retrieve a specific environment variable by ID.

GET /v1/environment/:id

Update Variable

Update a variable's value, description, or scope. The key is immutable.

PUT /v1/environment/:id

Request Body

FieldTypeDescription
valuestringNew value (re-encrypted if secret)
descriptionstringUpdated description
scopestringUpdated scope: all, webhook, cron, or mcp
curl

Delete Variable

Permanently delete an environment variable.

DELETE /v1/environment/:id

Warning

Any templates referencing this variable via {{env.KEY}} will fail to resolve at runtime.

Error Codes

StatusErrorDescription
400Bad RequestMissing key or value, invalid scope
401UnauthorizedInvalid or missing access token
404Not FoundVariable not found or access denied
409ConflictA variable with this key already exists

Related