---
title: "Keep settings outside the code · Agent Wranglers"
url: https://agentwranglers.se/playbook/engineering/running-in-production/settings-outside-the-code
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep settings outside the code

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Running in production](https://agentwranglers.se/playbook/engineering/running-in-production)
- Rule: Read everything that differs between test and production from the environment. Never edit code to deploy somewhere else.
- How: Read addresses, keys and limits from environment variables or a settings service at startup. Check that every required setting is present and valid before the app starts serving. Secrets follow the rules in the [security testing playbook](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/secrets-out-of-code).
- Check: Start the app with one required setting missing. It stops at once and names the setting.

Example:

```ts
const required = ['DATABASE_URL', 'PUBLIC_URL'] as const;
for (const name of required) {
  if (!process.env[name]) throw new Error(`Missing setting ${name}`);
}
```

```python
import os

REQUIRED = ["DATABASE_URL", "PUBLIC_URL"]
missing = [name for name in REQUIRED if not os.environ.get(name)]
if missing:
    raise SystemExit(f"Missing setting {', '.join(missing)}")
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers engineering playbook: https://agentwranglers.se/playbook/engineering/running-in-production/settings-outside-the-code`.

- Previous: [Make builds repeatable](https://agentwranglers.se/playbook/engineering/running-in-production/reproducible-builds)
- Next: [Log, track errors and alert](https://agentwranglers.se/playbook/engineering/running-in-production/logs-and-alerts)
- [Running in production](https://agentwranglers.se/playbook/engineering/running-in-production)