# Using Environment Variables inside Circle.yml

**URL:** <https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427>\
**Category:** Build Environment\
**Tags:** notifications, api, circle-yml\
**Created:** [March 1, 2016, 7:46pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427 "2016-03-01T19:46:51Z")\
**Posts on this page:** 20\
**Page:** 1

<div class="post-metadata">

**Author:** ![stuffandthings](https://avatars.discourse-cdn.com/v4/letter/s/eb8c5e/32.png) [@stuffandthings](https://discuss.circleci.com/u/stuffandthings)\
**Post date:** [March 1, 2016, 7:46pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/1 "2016-03-01T19:46:51Z")

</div>

Hi,

I’m setting up a webhook for CircleCI to talk to at the end of every build, but I want to not expose my authentication token to Github. I’ve tried setting an environment through the CircleCI web UI but it doesn’t seem to be working. At first I tried something like “-url: [https://www.example.com/endpoint?token=](https://www.example.com/endpoint?token=)\<%= API\_TOKEN =\>” and that gave me an uncaught exception, I then tried “-url: [https://www.example.com/endpoint?token=$API\_TOKEN](https://www.example.com/endpoint?token=%24API_TOKEN)” but that returns a 401 (most likely because API\_TOKEN is empty and authentication fails). I have also tried {API\_TOKEN} with the same result. What is the correct way to call an environment variable inside the ‘circle.yml’ file, and is setting an environment variable through the Circle CI web UI the correct way to do this?

---

<div class="post-metadata">

**Author:** ![FelicianoTech](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/felicianotech/32/21348_2.png) [@FelicianoTech](https://discuss.circleci.com/u/FelicianoTech)\
**Post date:** [March 2, 2016, 8:36pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/2 "2016-03-02T20:36:44Z")

</div>

Hey,

Currently, environment variables cannot be used in the webhooks section of circle.yml.

This will be brought up internally. Sounds like a very useful feature to have.

---

<div class="post-metadata">

**Author:** ![zixia](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/zixia/32/3035_2.png) [@zixia](https://discuss.circleci.com/u/zixia)\
**Post date:** [May 24, 2016, 4:43am UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/3 "2016-05-24T04:43:05Z")

</div>

It’s a pity.

So I have to put the token in circleci.yml file.

Do you have any other better way to do this?

---

<div class="post-metadata">

**Author:** ![a86c6f7964](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/a86c6f7964/32/13504_2.png) [@a86c6f7964](https://discuss.circleci.com/u/a86c6f7964)\
**Post date:** [July 22, 2016, 9:05pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/4 "2016-07-22T21:05:32Z")

</div>

I would like to be able to have my circle yaml look something like  
`machine: environment: APP_PATH: "testing" notify: webhooks: - url: "https://example.com?appPath=$APP_PATH"`  
just as good engineering practice, for variable re-use and what not.

---

<div class="post-metadata">

**Author:** ![GuillaumeGomez](https://avatars.discourse-cdn.com/v4/letter/g/dec6dc/32.png) [@GuillaumeGomez](https://discuss.circleci.com/u/GuillaumeGomez)\
**Post date:** [September 26, 2016, 1:51pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/5 "2016-09-26T13:51:03Z")

</div>

Any news on this?

---

<div class="post-metadata">

**Author:** ![kaikuchn](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/kaikuchn/32/14384_2.png) [@kaikuchn](https://discuss.circleci.com/u/kaikuchn)\
**Post date:** [October 12, 2016, 4:19pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/6 "2016-10-12T16:19:50Z")

</div>

You can already achieve this with these lines in your circle.yml:

```auto
    test:
      post:
        - >
          curl "https://some-service.com?token=${TOKEN}"

```

I assume this approach works everywhere… as I’m just executing a shell command.  
We use this for triggering a jenkins deployment.

```auto
    deployment:
      staging:
        branch: develop
        commands:
          - >
            curl "https://${JENKINS_USER}:${JENKINS_PASSWORD}@.../job/.../buildWithParameters?token=${JENKINS_TOKEN}

```

Works like a charm 🙂

---

<div class="post-metadata">

**Author:** ![AlanTurner](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/alanturner/32/14462_2.png) [@AlanTurner](https://discuss.circleci.com/u/AlanTurner)\
**Post date:** [October 24, 2016, 1:58pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/7 "2016-10-24T13:58:00Z")

</div>

Hi,

Has anyone got this working for webhooks?

I tried this:

> checkout:  
> post:  
> - sed -i “s/KEY/$API\_KEY/g” circle.yml

> notify:  
> webhooks:  
> # A list of hook hashes, containing the URL field  
> - url: [https://my.webook.com?key=KEY](https://my.webook.com?key=KEY)

I can see it updates the circle.yml file correctly - but my webhook still gets called with KEY rather than the value… ☹

---

<div class="post-metadata">

**Author:** ![FelicianoTech](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/felicianotech/32/21348_2.png) [@FelicianoTech](https://discuss.circleci.com/u/FelicianoTech)\
**Post date:** [October 24, 2016, 3:14pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/8 "2016-10-24T15:14:55Z")

</div>

Environment variables aren’t parsed for the webhooks section.

---

<div class="post-metadata">

**Author:** ![Daniel15](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/daniel15/32/14412_2.png) [@Daniel15](https://discuss.circleci.com/u/Daniel15)\
**Post date:** [October 26, 2016, 5:02am UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/9 "2016-10-26T05:02:35Z")

</div>

> [@FelicianoTech](#):
>
> Environment variables aren’t parsed for the webhooks section.

This greatly diminishes the usefulness of the webhooks, as there’s no way to verify the payload (since it’s impossible to add a secret token as a URL parameter). No secret token means that the web hook can’t trust **any** of the data received in the payload, as there’s no way to verify that the request actually came from CircleCI. This means the payload is essentially useless and any webhook is going to have to hit CircleCI’s build API to get the data.

Webhooks are still useful, but they must always ignore the payload other than the build number, especially in open-source projects where the `circle.yml` file is publicly accessible

---

<div class="post-metadata">

**Author:** ![jiancheung](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/jiancheung/32/14578_2.png) [@jiancheung](https://discuss.circleci.com/u/jiancheung)\
**Post date:** [November 11, 2016, 7:29am UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/10 "2016-11-11T07:29:49Z")

</div>

I also would like environment variables in webhooks but an alternative way to _verify_ that the request came from CircleCI is to do a GET request and see if the build payload matches up (because webhook notify’s payload should be identical to the Build API)

---

<div class="post-metadata">

**Author:** ![Daniel15](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/daniel15/32/14412_2.png) [@Daniel15](https://discuss.circleci.com/u/Daniel15)\
**Post date:** [November 11, 2016, 7:43am UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/11 "2016-11-11T07:43:05Z")

</div>

> an alternative way to verify that the request came from CircleCI is to do a GET request and see if the build payload matches up

That’s what I ended up doing - I only use the build number from the payload and ignore everything else. I do a GET to their API and then treat that data as the source of truth. It’s annoying to do that though, and it’d be unnecessary if CircleCI just included some sort of private token in the payload.

---

<div class="post-metadata">

**Author:** ![steve-jansen](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/steve-jansen/32/180_2.png) [@steve-jansen](https://discuss.circleci.com/u/steve-jansen)\
**Post date:** [January 2, 2017, 10:14pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/12 "2017-01-02T22:14:29Z")

</div>

+1 on environment variable support for webhook URLs… this is useful for both API tokens and passing parameters to the webhook

---

<div class="post-metadata">

**Author:** ![tobiastom](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/tobiastom/32/13816_2.png) [@tobiastom](https://discuss.circleci.com/u/tobiastom)\
**Post date:** [February 9, 2017, 11:23am UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/13 "2017-02-09T11:23:48Z")

</div>

+1 for having environment variables. I did try to solve a problem with notifications ([Formatted Slack message after successful build](https://discuss.circleci.com/t/formatted-slack-message-after-successful-build/514/4)) through a webhook, just to realise this will not provide me the `$BRANCH_NAME` variable.

---

<div class="post-metadata">

**Author:** ![BentOnCoding](https://avatars.discourse-cdn.com/v4/letter/b/57b2e6/32.png) [@BentOnCoding](https://discuss.circleci.com/u/BentOnCoding)\
**Post date:** [April 17, 2017, 11:03pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/14 "2017-04-17T23:03:07Z")

</div>

+1 on environment variable support for webhook URLs

---

<div class="post-metadata">

**Author:** ![danny-andrews](https://avatars.discourse-cdn.com/v4/letter/d/ba8739/32.png) [@danny-andrews](https://discuss.circleci.com/u/danny-andrews)\
**Post date:** [July 14, 2017, 5:41pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/15 "2017-07-14T17:41:43Z")

</div>

Any news on this? I’d like to be able to use environment variables in the `path` section of `store_artifacts` as well. E.g.:

```auto
- store_artifacts:
          path: $ARTIFACT_DIR
          destination: ./

```

---

<div class="post-metadata">

**Author:** ![BastienL](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/bastienl/32/17656_2.png) [@BastienL](https://discuss.circleci.com/u/BastienL)\
**Post date:** [August 17, 2017, 3:09pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/16 "2017-08-17T15:09:14Z")

</div>

With the release of CircleCI 2.0, can we expect the webhooks section to support one day the environment variables or will it never?

Without being able to use environment variables, I’m really don’t know how this feature can be useful.

Otherwise, I there a place where we can manually make a cURL POST at the really end of a build?

---

<div class="post-metadata">

**Author:** ![FelicianoTech](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/felicianotech/32/21348_2.png) [@FelicianoTech](https://discuss.circleci.com/u/FelicianoTech)\
**Post date:** [August 17, 2017, 3:41pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/17 "2017-08-17T15:41:01Z")

</div>

I don’t know.

First step is to make sure we have this as a proper feature request. Does [this one](https://discuss.circleci.com/t/add-webhook-secret-token-like-github/5185) make sense? If you, " ❤'ing" the top post will help gauge interest in it.

I do agree that webhooks should have environment variable support. That’s just common sense to me.

---

<div class="post-metadata">

**Author:** ![nigelellis](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/nigelellis/32/10639_2.png) [@nigelellis](https://discuss.circleci.com/u/nigelellis)\
**Post date:** [November 8, 2017, 4:46am UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/18 "2017-11-08T04:46:26Z")

</div>

I’m also looking for a way to get this support. I’d previously been using the webhook element but want to avoid inlining the API key.

I’ve tried using the notification tag with a command element:

```auto
notify:
  # The default webhook integration doesn't expand environment variables in the webhook url definition.
  # We workaround this by querying the build info via. the REST API then packaging this result as a notification
  # payload and pushing to OpsGenie. See https://circleci.com/docs/1.0/configuration/#notify for documentation.
  command: |
    BUILD_INFO=$(curl https://circleci.com/api/v1.1/project/github/$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME/$CIRCLE_BUILD_NUM?circle-token=$CIRCLE_LOCK_API_TOKEN)
    curl -d "{\"payload\": $BUILD_INFO}" -H "Content-Type: application/json" -X POST https://api.opsgenie.com/v1/json/circleci?apiKey=$OPS_GENIE_API_KEY

```

I’ve manually SSH’d into the Circle pod for the build and the commands work fine when run directly. However they don’t appear to be called when run as part of the regular build file. i.e. CI seems to ignore the command sub-element. Am I missing something or is this WAI?

---

<div class="post-metadata">

**Author:** ![DPUkyle](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/dpukyle/32/10026_2.png) [@DPUkyle](https://discuss.circleci.com/u/DPUkyle)\
**Post date:** [December 14, 2017, 1:00am UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/19 "2017-12-14T01:00:17Z")

</div>

The inability to parse an environment variable in the `notify` section is disappointing - my project(s) are all open source but my team’s private chat room is not; I really don’t want to post our chat room’s API token into the config.yml file. An env var would be the perfect way to obscure it!

---

<div class="post-metadata">

**Author:** ![gregoralbrecht](https://sea2.discourse-cdn.com/circleci/user_avatar/discuss.circleci.com/gregoralbrecht/32/11099_2.png) [@gregoralbrecht](https://discuss.circleci.com/u/gregoralbrecht)\
**Post date:** [January 17, 2018, 1:07pm UTC](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427/20 "2018-01-17T13:07:37Z")

</div>

I absolutely agree with everyone here, not having the option of using environment variables inside the config makes using CircleCI pretty difficult right now. What is even more frustrating is your lack of communication regarding this. There are several threads where people discuss this issue only to receive a one-line answer that doesn’t solve anything.

edit: typo

[Next page](https://discuss.circleci.com/t/using-environment-variables-inside-circle-yml/2427.md?page=2)