# Values on your machine and in production

In production, values come from the platform's environment, or from its
secret manager, which sets the same variables. On your machine they come
from one file, `.env.local`, which git ignores. Jadpo has no `.env`,
`.env.development` or layering of files. When the process's environment and
the file both set a variable, the environment wins, and nothing else is
read.

Tests use each field's `test:` value, then its default, and `jadpo test`
makes a random throwaway value for every secret. A single test can override
a value with its `config:` setting
([Configuration in tests](configuration-in-tests.md)).

## Setting a value: `jadpo config set`

Never type a secret into a chat with an agent. The agent asks you to run
this, and you type the value at the prompt:

```text
$ jadpo config set session_signing_key
? Enter SESSION_SIGNING_KEY hidden
session_signing_key configured locally
    variable  SESSION_SIGNING_KEY
    file      .env.local
```

The command asks at a prompt, never through a command-line argument, and
hides what you type when the setting is secret. It checks the value against
the field's type before writing anything. A value that breaks the type is
refused by naming the rule it breaks, never by printing the value.

It writes `.env.local` safely: only to an ordinary file, through a
temporary file only its owner can read, only if the file hasn't changed
since it was read, and with `.env.local` added to `.gitignore`.

## Checking values: `jadpo config check`

`jadpo config check` lists each field as `set`, `default`, `missing` or
`invalid`, with the variable it reads, and never the value:

```text
$ jadpo config check
Values
  database_url         set      DATABASE_URL
  session_signing_key  missing  SESSION_SIGNING_KEY
  log_level            default  LOG_LEVEL

error: `SESSION_SIGNING_KEY` isn't set
  reason: `session_signing_key` is required: it has no `default:`, so the app can't start without a value for it.
  next: Run `jadpo config set session_signing_key` to store it in `.env.local`, or set `SESSION_SIGNING_KEY` in the environment (human)
  rule: configuration.value_missing
  help: https://jadpo.dev/docs/errors/configuration.value_missing

config incomplete: 1 problem, 3 settings

next: jadpo config set session_signing_key  stores it in .env.local
```

`config set` needs a terminal and refuses `--json`. `config check --json`
lists the same settings as data. Both commands are listed with the others
in [Commands for the database, settings and translations](commands-for-the-database-settings-and-translations.md).