# getstream env

Fetch an app's API key (and secret, for server targets) and write them into the file your platform expects. Run it from a directory linked with `getstream init`, or point it at an app another way - see [how credentials are resolved](https://getstream.io/cli/docs/concepts/projects-and-credentials/).

```bash
getstream env
getstream env --target next
getstream env --app-id 1608483
```

The publishable key is written with the framework's client prefix. The server-only secret is written for server targets and omitted for client-only ones. The secret is only ever written to the file, never printed.

## Targets

| Target    | File                | Key variable                 | Secret |
| --------- | ------------------- | ---------------------------- | ------ |
| `web`     | `.env`              | `STREAM_API_KEY`             | yes    |
| `next`    | `.env.local`        | `NEXT_PUBLIC_STREAM_API_KEY` | yes    |
| `vite`    | `.env.local`        | `VITE_STREAM_API_KEY`        | no     |
| `expo`    | `.env`              | `EXPO_PUBLIC_STREAM_API_KEY` | no     |
| `ios`     | `Secrets.xcconfig`  | `STREAM_API_KEY`             | no     |
| `android` | `local.properties`  | `STREAM_API_KEY`             | no     |
| `flutter` | `dart_defines.json` | `STREAM_API_KEY`             | no     |

The target is autodetected from the project. In an interactive terminal the CLI shows a platform picker preselected to the detection, so a wrong guess is one keystroke to fix; in a non-interactive run a failed detection errors and asks for `--target`.

## Flags

| Flag                  | Effect                                                         |
| --------------------- | -------------------------------------------------------------- |
| `-t, --target <name>` | Target platform. One of the values above. Default: autodetect. |
| `-o, --out <file>`    | Write to this file instead of the target's default.            |
| `--no-gitignore`      | Skip the `.gitignore` safety check.                            |
| `--app-id <id>`       | Write this app's credentials instead of the linked project's.  |

## Behavior

- Updates the key and secret lines in place if they exist, appends them if not, and leaves every other line untouched. Re-run it after rotating keys.
- Creates the file if it doesn't exist.
- Writes a `# Stream app: <name> (<id>)` comment above the key variable, so the file says which app it belongs to.
- Adds the file to `.gitignore` unless `--no-gitignore` is passed, and warns when the written file is already tracked by git - a tracked secret file needs a `git rm --cached` before the ignore takes effect.
- For the mobile targets, prints the wiring steps the file needs: Flutter runs with `--dart-define-from-file=dart_defines.json` and reads the key with `String.fromEnvironment`; iOS sets `Secrets.xcconfig` as the target's configuration file and exposes the key through `Info.plist`; Android reads `local.properties` in the module `build.gradle` and exposes the key as a `buildConfigField`.

## See also

- [Use the CLI in CI](https://getstream.io/cli/docs/ci/): credentials for headless workflows
- [Backend SDKs](https://getstream.io/docs/platform/backend-sdks/): the server SDKs these keys are written for

---

For the most recent version of this documentation, visit [https://getstream.io/cli/docs/commands/env/](https://getstream.io/cli/docs/commands/env/).