1# Container Apps Environment Variables
2 
3## Standard Environment Variables
4 
5```bicep
6env: [
7  {
8    name: 'APPLICATIONINSIGHTS_CONNECTION_STRING'
9    value: applicationInsights.properties.ConnectionString
10  }
11  {
12    name: 'AZURE_CLIENT_ID'
13    value: managedIdentity.properties.clientId
14  }
15]
16```
17 
18## Secret References (Key Vault)
19 
20Use secrets for sensitive values:
21 
22```bicep
23configuration: {
24  secrets: [
25    {
26      name: 'database-url'
27      keyVaultUrl: 'https://myvault.vault.azure.net/secrets/database-url'
28      identity: managedIdentity.id
29    }
30  ]
31}
32 
33template: {
34  containers: [
35    {
36      env: [
37        {
38          name: 'DATABASE_URL'
39          secretRef: 'database-url'
40        }
41      ]
42    }
43  ]
44}
45```
46 
47## Common Variables
48 
49| Variable | Source | Notes |
50|----------|--------|-------|
51| `APPLICATIONINSIGHTS_CONNECTION_STRING` | App Insights | Telemetry |
52| `AZURE_CLIENT_ID` | Managed Identity | SDK auth |
53| `DATABASE_URL` | Key Vault secret | Connection string |
54| `REDIS_URL` | Key Vault secret | Cache connection |
55 
56## Best Practices
57 
58- Never hardcode secrets in Bicep
59- Use Key Vault references for all sensitive values
60- Use Managed Identity for authentication
61- Set `AZURE_CLIENT_ID` for SDK-based auth
62