Get Variables

List env vars, with the values of the caller's own vars.

The browser gets its values here, not one reveal at a time: this page is the only interface a human has for setting a secret now that MCP can't, so it has to be usable. The masking is client-side again, as it was before.

Filtering is still server-side: Railway-injected vars never leave the backend, and platform-managed ones (DATABASE_URL, BACKUP_HMAC_SECRET, ...) are listed only to super-admins — and even for them, only as metadata. Their values stay on /variables/reveal, one key at a time.