Variables

Deployments need configuration that doesn't belong in code: API keys, feature flags, log levels. On Dynamiq, Service Deployments take environment variables — plain or secret — declared at deploy time. Workflow Apps don't use environment variables at all; their configuration flows through platform primitives instead. This page covers both.

Where configuration lives, by deployment type

Declare variables on a Service Deployment

Environment variables are part of the deployment configuration you send to POST /v1/services/{service_id}/deploy. Each entry has a name, a value (both required), and an optional secret flag:

dynamiq service deploy --id <service-id> \
  --source ./ \
  --env LOG_LEVEL info \
  --env FEATURE_FLAGS "reports,exports" \
  --env-secret OPENAI_API_KEY "$OPENAI_API_KEY" \
  --env-secret DATABASE_URL "$DATABASE_URL"

curl -X POST "https://api.getdynamiq.ai/v1/services/$SERVICE_ID/deploy" \
  -H "Authorization: Bearer $DYNAMIQ_PAT" \
  -H "Content-Type: application/json" \
  -d '{
    "image": "registry.example.com/qa-service:1.0.0",
    "resources": {
      "requests": {"cpu": "100m", "memory": "256Mi"},
      "limits": {"cpu": "200m", "memory": "512Mi"}
    },
    "env": [
      {"name": "LOG_LEVEL", "value": "info"},
      {"name": "FEATURE_FLAGS", "value": "reports,exports"},
      {"name": "OPENAI_API_KEY", "value": "'"$OPENAI_API_KEY"'", "secret": true},
      {"name": "DATABASE_URL", "value": "'"$DATABASE_URL"'", "secret": true}
    ]
  }'

Variables are per deployment: they're part of the deployment record, and changing a value means starting a new deployment with the updated env list. There is no separate variables-edit endpoint.

How secrets are stored

Plain and secret variables both reach your process as ordinary environment variables, but they travel differently:

• Plain variables (secret omitted or false) are set directly on the container spec.
• Secret variables ("secret": true) are written to a Kubernetes Secret object for the deployment and loaded into the container from there. They never appear in the pod's plain env list.

Your code reads both the same way:

import os

log_level = os.environ.get("LOG_LEVEL", "info")
openai_api_key = os.environ["OPENAI_API_KEY"]
database_url = os.environ["DATABASE_URL"]

Reserved platform variables

The platform injects two variables into every Service Deployment, delivered through the same secret mechanism:

These names are reserved — if you pass your own DYNAMIQ_SERVICE_ID or DYNAMIQ_SERVICE_TOKEN, the platform's values win and yours are ignored.

Good practices

• Pass secrets from your own environment or CI secret store into --env-secret — never commit values into scripts.
• Treat a deploy as the unit of change: rotating a secret is a redeploy with the new value, which also restarts the pods so the new value takes effect everywhere at once.
• Keep workflow credentials in Connections, not in service variables, even when a Service Deployment and a workflow App cooperate — Connections are shared, auditable, and editable without redeploys.

Next steps