{"service":"fullstacked-cloud-docs","version":"1.22.3","environment":"live","generatedAt":"2026-10-24T09:39:52.200Z","formats":{"html":"https://docs.fullstacked.cloud/","markdown":"https://docs.fullstacked.cloud/?format=md","json":"https://docs.fullstacked.cloud/?format=json"},"services":{"console":"https://console.fullstacked.cloud","auth":"https://auth.fullstacked.cloud","git":"https://git.fullstacked.cloud","tunnels":"https://tunnels.fullstacked.cloud","tunnelsHost":"tunnels.fullstacked.cloud","mcp":"https://mcp.fullstacked.cloud","install":"https://install.fullstacked.cloud","docs":"https://docs.fullstacked.cloud"},"runtime":{"version":"1.0.0-alpha.1844","guide":"https://docs.fullstacked.cloud/runtime?format=md"},"dataEngineLimits":{"postgres":{"image":"postgres:18.6-alpine","port":5432,"memoryMB":256,"cpus":2,"pids":256},"redis":{"image":"redis:8.10.2-alpine","port":6379,"memoryMB":256,"cpus":1,"pids":128},"mongodb":{"image":"mongo:8.3.11-noble","port":27017,"memoryMB":512,"cpus":2,"pids":512},"s3":{"image":"rustfs/rustfs:1.0.0","port":9000,"memoryMB":768,"cpus":2,"pids":1024}},"projectRuntimeEnv":[{"name":"TUNNELS_HOST","injectedBy":"GET /api/v1/projects/:id/env","description":"Tunnels hub host for tunnel.register from fullstacked/tunnel."},{"name":"AUTH_HOST","injectedBy":"GET /api/v1/projects/:id/env","description":"Bare host of the Authentication service."},{"name":"AUTH_URL","injectedBy":"GET /api/v1/projects/:id/env","description":"Base URL of the Authentication service (GET ${AUTH_URL}/api/v1/me)."},{"name":"DOCS_URL","injectedBy":"GET /api/v1/projects/:id/env","description":"Base URL of this documentation (?format=md | ?format=json)."},{"name":"AUTH_TOKEN","injectedBy":"Client GUI / action runner at launch (in memory, never stored)","description":"The signed-in user's fsc_* bearer token: Authorization: Bearer ${AUTH_TOKEN}."}],"topics":[{"slug":"project-runtime","title":"Injected process.env","url":"https://docs.fullstacked.cloud/project-runtime","markdownUrl":"https://docs.fullstacked.cloud/project-runtime?format=md","jsonUrl":"https://docs.fullstacked.cloud/project-runtime?format=json","markdown":"# Injected process.env\n\nEvery FullStacked Cloud project reads its configuration from `process.env`: the platform hosts, the credentials of linked managed data and Edge tunnels, the project's custom variables, and `AUTH_TOKEN`, the current user's own token. The environment comes from `GET https://git.fullstacked.cloud/api/v1/projects/:id/env`, resolved for the caller, plus `AUTH_TOKEN` added at launch. Code never hardcodes a host, a database user or a token.\n\n## Where the environment comes from\n\n| Where the code runs | `process.env` contains |\n| :--- | :--- |\n| FullStacked Cloud Client GUI | The resolved environment of the signed-in user plus `AUTH_TOKEN` = their session token. If the environment cannot be fetched, the project still runs with `AUTH_TOKEN` alone. |\n| Local CLI (`npx fullstacked`) | `<project>/.env` merged with `-e KEY=VALUE` flags (flags win). Write `.env` from `GET .../env?format=dotenv` and pass the token: `npx fullstacked -e AUTH_TOKEN=$AUTH_TOKEN` with a personal access token (`fsc_pat_...`, https://console.fullstacked.cloud Settings, Access tokens). Keep `.env` out of Git. |\n| Project action run (`actions/<name>.ts`) | The environment resolved for the caller of the run, `AUTH_TOKEN` = the caller's token, plus run variables (see [Project Actions](https://docs.fullstacked.cloud/actions)). |\n\n## Variables\n\n| Variable | Present | Value |\n| :--- | :--- | :--- |\n| `AUTH_URL` | Resolved environment | Authentication service base URL, `https://auth.fullstacked.cloud` here. Use for `/api/v1/me`, `/api/v1/user/access`, token exchange. |\n| `AUTH_HOST` | Resolved environment | Its host, `auth.fullstacked.cloud`. |\n| `TUNNELS_HOST` | Resolved environment | Tunnels hub host for `tunnel.register({ host })`, `tunnels.fullstacked.cloud`. |\n| `DOCS_URL` | Resolved environment | This documentation, `https://docs.fullstacked.cloud` (`?format=md` for Markdown). |\n| `AUTH_TOKEN` | At launch only | The current user's FullStacked Cloud token: `fsc_ses_...` (Client GUI), `fsc_ath_<slug>_...` (enterprise sign-in), `fsc_pat_...` (personal access token) or the action caller's token. Never part of `GET .../env`, never stored in the project. |\n| `PG_DATA_TOKEN`, `REDIS_DATA_TOKEN`, `MONGO_DATA_TOKEN`, `S3_DATA_TOKEN` | Linked data instance | `tun_...` routing token of the instance's tunnel at the caller's access level. Use as `` `${AUTH_TOKEN}:${PG_DATA_TOKEN}` ``. |\n| `DATA_USER`, `DATA_PASSWORD` | Linked PostgreSQL, Redis, MongoDB | `app_rw` or `app_ro` and its password, matching the caller's access (read-write or read-only). |\n| `DATA_DB` | Linked PostgreSQL, MongoDB | Database name, e.g. `data_pg_1`, `data_mongo_1`. Not set for Redis. |\n| `DATA_KEY_ID`, `DATA_KEY_SECRET`, `DATA_BUCKET` | Linked S3 | Access key, secret key and bucket name for the caller's access level. |\n| `<PREFIX>_TUNNEL_TOKEN` | Linked Edge tunnel | `tun_...` token of the tunnel. Use as `` `${AUTH_TOKEN}:${OFFICE_API_TUNNEL_TOKEN}` ``. |\n| Custom variables | Set on the project | Any `NAME=value` stored with `PUT .../env` (Console: Project, Environment). |\n\nThe four platform hosts are part of every resolved environment, for the environment the project belongs to (live here): the same code runs against test and live. They are missing when no environment was resolved: a Client GUI launch whose environment request failed (only `AUTH_TOKEN` is set), or a local CLI run without a `.env` written from `GET .../env`. Check them like any other variable.\n\n## Naming rules\n\n- The **oldest linked data instance** gets unprefixed names (`DATA_USER`, `PG_DATA_TOKEN`, ...).\n- Every **other linked data instance** gets the same names prefixed with its display name: upper-cased, non-alphanumeric runs replaced by `_`, leading and trailing `_` trimmed, `_` prepended before a leading digit (instance `analytics-db` gives `ANALYTICS_DB_DATA_USER`, `ANALYTICS_DB_PG_DATA_TOKEN`, ...).\n- **Edge tunnels** are always prefixed with the tunnel name, normalized the same way (`office-api` gives `OFFICE_API_TUNNEL_TOKEN`). Tunnel names are unique per Edge only: two linked tunnels with the same name produce the same variable, and the second is dropped into `conflicts`. Give one of them a prefix mapping.\n- A **prefix mapping** (`PUT .../env` with `mappings`) overrides the prefix of one resource; an empty prefix is not allowed (prefix: `A-Z` then up to 63 of `A-Z`, `0-9`, `_`).\n- Names never overwrite each other. Platform hosts come first, then linked data (oldest link first), then tunnels, then custom variables; a later entry with an existing name is dropped and reported in `conflicts`.\n- Resources the caller cannot use are omitted silently, so a variable can be absent for one user and present for another: check before use.\n\n```ts\nfunction requireEnv(name: string): string {\n    const value = process.env[name];\n    if (!value) throw new Error(`${name} is not set: link the resource to the project or run with AUTH_TOKEN`);\n    return value;\n}\n```\n\n## GET /api/v1/projects/:id/env\n\n`GET https://git.fullstacked.cloud/api/v1/projects/<projectId>/env?format=json|dotenv` with `Authorization: Bearer <fsc_* token>`. Any project tier may call it; the values are resolved with the caller's own access. MCP: `projects_get_env`.\n\n```json\n{\n  \"projectId\": \"7f3b89a2-4c1e-48a0-9d21-f8e910243abc\",\n  \"project\": \"alice/task-flow\",\n  \"accessTier\": \"FULL_ACCESS\",\n  \"env\": {\n    \"TUNNELS_HOST\": \"tunnels.fullstacked.cloud\",\n    \"AUTH_HOST\": \"auth.fullstacked.cloud\",\n    \"AUTH_URL\": \"https://auth.fullstacked.cloud\",\n    \"DOCS_URL\": \"https://docs.fullstacked.cloud\",\n    \"PG_DATA_TOKEN\": \"tun_4b8c9d...\",\n    \"DATA_USER\": \"app_rw\",\n    \"DATA_PASSWORD\": \"...\",\n    \"DATA_DB\": \"data_pg_1\",\n    \"OFFICE_API_TUNNEL_TOKEN\": \"tun_3f9a2b...\",\n    \"APP_TITLE\": \"Task Flow\"\n  },\n  \"meta\": { \"PG_DATA_TOKEN\": { \"source\": \"linked_data\", \"resourceId\": \"9b2f6c1e-...\", \"name\": \"tasks-db\", \"engine\": \"postgres\", \"access\": \"READ_WRITE\", \"secret\": true } },\n  \"resources\": [{ \"source\": \"linked_data\", \"resourceId\": \"9b2f6c1e-...\", \"name\": \"tasks-db\", \"prefix\": \"\", \"mapped\": false }],\n  \"variables\": { \"APP_TITLE\": \"Task Flow\" },\n  \"mappings\": {},\n  \"conflicts\": []\n}\n```\n\n`meta` has one entry per variable (`source`: `platform`, `linked_data`, `linked_tunnel` or `custom`; `secret` is false only for hosts, `DATA_USER`, `DATA_DB`, `DATA_BUCKET` and custom variables). `format=dotenv` returns the same `env` as `KEY=value` lines.\n\n## PUT /api/v1/projects/:id/env\n\nRequires `write` on the project. MCP: `projects_set_env`.\n\n```json\n{ \"variables\": { \"APP_TITLE\": \"Task Flow\", \"OLD_FLAG\": null }, \"mappings\": { \"<resourceId>\": { \"prefix\": \"CACHE\" } } }\n```\n\n- `null` removes a variable or mapping.\n- Names: `^[A-Z_][A-Z0-9_]{0,127}$`; values: single-line strings up to 4096 characters; at most 200 variables and 100 mappings.\n- Setting `AUTH_TOKEN`, `AUTH_URL`, `AUTH_HOST`, `TUNNELS_HOST` or `DOCS_URL` is refused (`400 RESERVED_VARIABLE`).\n- Custom variables are visible to every project tier, including release-only users: store configuration there, never secrets.\n\n## Endpoints\n\n### GET /api/v1/projects/:id/env\n\nThe project's resolved runtime environment: DATA_* wiring and tokens of linked instances, platform URLs (AUTH_URL, AUTH_HOST, TUNNELS_HOST, DOCS_URL) and custom variables. ?format=json|dotenv; never contains AUTH_TOKEN.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\ncurl:\n\n```bash\ncurl -sS -H \"Authorization: Bearer $AUTH_TOKEN\" \"https://git.fullstacked.cloud/api/v1/projects/<projectId>/env?format=dotenv\"\n```\n\n### PUT /api/v1/projects/:id/env\n\nMerges { variables?, mappings? } into the project's environment config (null removes a key). Needs write.\n\n- **Service**: `git` (`https://git.fullstacked.cloud`)\n- **Auth**: Bearer fsc_*\n\nRequest:\n\n```json\n{\n  \"variables\": {\n    \"API_BASE\": \"https://example.com\"\n  }\n}\n```\n"}],"endpoints":[{"service":"git","topic":"project-runtime","auth":"Bearer fsc_*","id":"git.getEnv","method":"GET","path":"/api/v1/projects/:id/env","summary":"The project's resolved runtime environment: DATA_* wiring and tokens of linked instances, platform URLs (AUTH_URL, AUTH_HOST, TUNNELS_HOST, DOCS_URL) and custom variables. ?format=json|dotenv; never contains AUTH_TOKEN.","codeExamples":{"curl":"curl -sS -H \"Authorization: Bearer $AUTH_TOKEN\" \"https://git.fullstacked.cloud/api/v1/projects/<projectId>/env?format=dotenv\""},"fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/env"},{"service":"git","topic":"project-runtime","auth":"Bearer fsc_*","id":"git.setEnv","method":"PUT","path":"/api/v1/projects/:id/env","summary":"Merges { variables?, mappings? } into the project's environment config (null removes a key). Needs write.","requestExample":{"variables":{"API_BASE":"https://example.com"}},"fullUrl":"https://git.fullstacked.cloud/api/v1/projects/:id/env"}]}