Environment variables
Environment variables hold credentials and config for your jobs (API tokens, URLs, database hosts). You enter a value once on your account, bind its name to jobs, and every machine that runs those jobs gets the value. Nothing is pasted into job commands.
How binding works
Section titled “How binding works”A job is bound to a variable by name. The job editor has an Environment
picker; the job detail page shows each bound variable as Active,
Archived or Missing. Because the binding is the name, renaming a variable
updates its bindings, and deleting one leaves them dangling (state missing).
At run time norc run puts only the variables bound to that job into the
command’s environment. Values are never written into the crontab or the
Task Scheduler entry. Only the names are, as --env A,B on the managed line.
Where values live and who can read them
Section titled “Where values live and who can read them”- Values are encrypted on the norc server with your account key. This is not end-to-end encryption: a compromise of the norc database and key would expose them, the same as job commands today.
- A value is write-only. After you save it, no app or CLI command shows it again. To change it, enter a new one.
- A machine receives only the variables bound to its own jobs. It keeps them
in
~/.config/norc/env(mode 0600 on macOS and Linux; on Windows norc applies an access restriction that has not been verified on every Windows version). - The cache is removed when you unpair, sign out, re-pair, or delete the
machine from the desktop app. A machine that never comes online again keeps
its file: delete
~/.config/norc/envon hardware you retire. - Known values are redacted from the output tail that norc reports for a run.
Names and plan limits
Section titled “Names and plan limits”Names use A-Z, 0-9 and _, cannot start with a digit, and are at most
128 characters.
| Plan | Variables |
|---|---|
| Free | 5 |
| Pro | 25 |
| Power | 100 |
| Team | custom |
Archived variables count toward the limit. Deleting one frees a slot.
Archive and delete
Section titled “Archive and delete”- Archive keeps the value but stops delivering it. Bound jobs fail on their next run. Restore at any time to resume.
- Delete removes the variable for good. Bound jobs fail as
not founduntil you rebind or unbind them. Delete needs a fresh sign-in.
Both show the jobs and machines that would break before you confirm.
Next: how-to guides and the CLI reference.