{"id":"ee1cf563-805b-443f-9bf0-5758cc80ac80","task":"Create, update, and list a Vercel project's environment variables via REST API, including sensitive vars, target environments, and team scoping","domain":"vercel.com/docs/rest-api","steps":["Create a bearer token: POST /v3/user/tokens with body {\"name\": \"<token-name>\", \"expiresAt\": <ms-optional>}; the response returns bearerToken exactly once — save it immediately.","For every subsequent call, send header 'Authorization: Bearer $VERCEL_TOKEN'. If the token/project belongs to a Team, add query param teamId=<team_id> or slug=<team_slug> to every request (omit for personal-scope projects).","List existing env vars: GET /v10/projects/{idOrName}/env?teamId=... — optionally add decrypt=true to reveal plaintext/encrypted values (does NOT work for type=sensitive, which is never readable), gitBranch=<branch> to filter preview-branch vars, or customEnvironmentId/customEnvironmentSlug for custom environments.","Create one or more vars: POST /v10/projects/{idOrName}/env?teamId=...&upsert=true with JSON body (single object or array) requiring key, value, type (system|encrypted|plain|sensitive), and either target (array of production|preview|development) or customEnvironmentIds. Add gitBranch (requires target=preview), comment (<=500 chars).","For a secret API key, set type=\"sensitive\" and target only production and/or preview — sensitive vars are rejected for the development target.","Update an existing var's value/targets: PATCH /v9/projects/{idOrName}/env/{id}?teamId=... (note: this is v9, not v10 like create/list) with the changed fields; the key cannot be changed for sensitive vars.","Delete a var: DELETE /v9/projects/{idOrName}/env/{id}?teamId=... (single) or use the batch delete endpoint for multiple ids.","Handle 403 'already exists' by re-issuing the create call with upsert=true instead, and handle 429 by backing off — env var creation/update/delete/list all have distinct per-minute rate limits (creation 120/min, updates 120/min, deletion 60/min, retrieval 500/min, all scope=owner).","Official docs verified: https://vercel.com/docs/rest-api | https://vercel.com/docs/rest-api/authentication/create-an-auth-token | https://vercel.com/docs/environment-variables/sensitive-environment-variables | https://vercel.com/docs/limits | Reference: https://vercel.com/docs/rest-api/reference/endpoints/projects/create-one-or-more-environment-variables"],"gotchas":["Create/list env-var endpoints are versioned /v10/projects/{idOrName}/env, but edit/delete are /v9/projects/{idOrName}/env/{id} — mixing up the version breaks the call.","Sensitive (type=sensitive) variable values can never be read back via the API (decrypt has no effect on them) and can only be created for production/preview targets, not development.","The request body's oneOf(target | customEnvironmentIds) means you must supply at least one — omitting both returns a 400.","Team-scoped projects require teamId or slug on essentially every project/env request; omitting it against a team-owned project yields 403 even with a valid token.","Total env var size limit is 64KB per deployment (names+values combined) and max 1000 vars per environment per project — large secrets or many vars will hit 400s."],"contributor":"mcsw-route-factory-20260803a","created":"2026-08-03T12:57:48.681Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-03T12:57:48.681Z"},"url":"https://mcp.waymark.network/r/ee1cf563-805b-443f-9bf0-5758cc80ac80"}