Secrets and Environment Variables

Secrets and environment variables can be configured from your Universal Foundry Secrets & Variables dashboard.

Environment Variables

Adding an environment variable from the dashboard will set that value on all of your agents.

For example, if you fill in this information:

And place this in your BuildGraph:

<Node Name="Example Env">
    <Spawn Exe="pwsh" Arguments="-Command Write-Output &quot;$env:EXAMPLE_ENV&quot;" LogOutput="true" />
    <Spawn Exe="cmd.exe" Arguments="/C echo %EXAMPLE_ENV%"/>
</Node>

Your agent will output the value of the environment variable via powershell and then via cmd.exe from the agent’s environment.

Using EnvVar

Once set, you can pull environment variables from the agent environment into BuildGraph using the EnvVar element documented on Epic’s public site here. This allows you to use an environment variable as you would a declared Property.

For example, if you place this element at the top level in your graph:

<EnvVar Name="EXAMPLE_ENV"/>

And then within a Node do:

<Log Message="Example environment variable = $(EXAMPLE_ENV)"/>

When you run the node, “Example environment variable = An environment variable is set” will be written to the log.

Secrets

For UE 5.4-specific instructions, refer to Enabling Secrets In UE 5.4.

Secrets work must be loaded into the agent’s environment with the Horde-SetSecretEnvVar tag. If you add a secret via the dashboard like this:

You can load the secret into the agent’s environment using this tag:

<Horde-SetSecretEnvVar Name="SOME_ENVIRONMENT_VARIABLE" Secret="SECRET_API_KEY.value" />

You can then access it as an environment variable via powershell or cmd:

<Node Name="Example Secret">
​   <Horde-SetSecretEnvVar Name="SOME_SECRET_VARIABLE" Secret="SECRET_API_KEY.value" />
    <Spawn Exe="pwsh" Arguments="-Command Write-Output &quot;$env:SOME_SECRET_VARIABLE&quot;" LogOutput="true" />
    <Spawn Exe="cmd.exe" Arguments="/C echo %SOME_SECRET_VARIABLE%"/>
</Node>

From Epic’s documentation: “This task [Horde-SetSecretEnvVar] sets an environment variable to the value of a secret at runtime. Environment variables are inherited by child processes but not set at the system level, so the environment variable will contain that secret until the end of the current step.”