Skip to content
norc

Use environment variables

Concepts: Environment variables.

Add a variable

Section titled “Add a variable”
  • Web vault: open Environment in the navigation and choose New variable. Enter a name, a value and an optional description.
  • Desktop: switch the title-bar view to Environment (or use the command palette, Open Environment), then choose New variable.
  • Mobile: open Profile, then Environment variables.
  • CLI: norc env set NAME. The value comes from stdin or a hidden prompt, never from the command line:
Terminal window
echo "$TOKEN" | norc env set STRIPE_KEY

norc env needs a user session: run norc login --email <email> once. A host paired with norc login --key keeps its pairing and gains the session.

Bind it to a job

Section titled “Bind it to a job”
  • Vault, desktop, mobile: pick the variable in the job editor’s Environment picker. You can create a variable from the picker.
  • CLI: add --env flags last:
Terminal window
norc jobs add "0 3 * * *" /opt/backup/nightly.sh --env STRIPE_KEY --env DB_HOST

A bound name that does not exist fails at run time (env NAME not found). Run the job once after binding to confirm.

Rotate a value

Section titled “Rotate a value”

Edit the variable and enter the new value (the field is never prefilled), or run echo "$NEW" | norc env set NAME. Running machines pick it up at their next sync. A machine that is offline runs with its cached value until it reconnects.

Archive or delete

Section titled “Archive or delete”
  1. Choose Archive or Delete on the variable (CLI: norc env archive NAME or norc env rm NAME).
  2. Read the impact list: the jobs and machines that will fail on their next run. Archived jobs are listed apart as not affected.
  3. Confirm. Delete asks you to type the name, then a fresh sign-in (your 2FA code, or an emailed code).

To undo an archive, choose Restore (norc env restore NAME); delivery resumes on the next sync. A delete cannot be undone: create the variable again with the same name and the existing bindings match it.

Retire a machine safely

Section titled “Retire a machine safely”
  1. On the machine itself, delete it in the desktop app, or run norc logout on a CLI host. This removes the local cache.
  2. Deleting a remote machine from the vault or mobile does not clear its file. On that hardware, or on any machine that will not come online again, delete ~/.config/norc/env yourself.
  3. Rotate any value that machine held if the hardware leaves your control.