Commands
Named after the ones dotenvx, Doppler and Infisical already use.
Everyday
envs init |
create a catalog and print its recovery codes once |
envs load <path>… |
put env files into a new release |
envs run -- <cmd> |
run a command with the values in its environment |
envs get <KEY> |
print one value; --format shell|eval|json |
envs set <KEY> <VALUE> |
change one value, as a new release |
envs del <KEY> |
remove one key, as a new release |
envs ls [--keys] |
what is in the catalog |
Understanding what you have
envs doctor |
where each value came from, and what disagrees |
envs doctor --key <KEY> |
one key's sources and which wins |
envs doctor |
one secret held under two names, which name comparison cannot see: rotating one leaves the other holding the retired value |
envs doctor |
an .env.example that no longer matches, so nobody
starts from it three keys short
|
envs validate <path> |
is this file env format |
envs history |
releases, newest first, current marked |
envs rollback <id> |
point at an earlier release |
Keys and safety
envs rotate --key |
replace the key without re-encrypting a value |
envs backup |
an encrypted snapshot, to a directory or S3 |
envs restore <name> |
put one back; a recovery code is enough |
envs gitignore |
make sure git ignores the catalog |
envs precommit |
refuse the commit if a secret is about to go into it |
envs genexample |
key names with no values |
Everything else
envs export --yes |
decrypt and print: csv, env, json or shell |
envs watch add|exclude|scan |
which env files this project looks at |
envs build --out <path> |
bake chosen values into a module |
envs serve |
hand the sealed catalog to teammates |
envs migrate |
bring an older catalog up to this build's schema; never done for you, so a floating CLI cannot upgrade a pinned catalog |
Templates
A template is a schema for keys and never carries a value. Applying one
declares the keys a service needs, so
envs doctor can say which are missing, which do not match
the shape the publisher declared, and which are overdue for rotation —
naming keys, never values.
| Command | What it does |
|---|---|
envs add <template.json> |
declare the keys a template names; sets no value, and leaves any key you already have untouched |
envs template lint <file.json> |
for publishers: refuses unnamed fields, unanchored patterns, and links that leave the provider's own domain |
Signing in
Optional, and only for a remote catalog. The CLI shows a short code to approve in a browser, so it works over SSH without opening a callback server. Everything else works without an account, and signing out leaves the local catalog exactly as it was.
| Command | What it does |
|---|---|
envs login |
print a code to approve in a browser, on any device; no callback server, so it works over SSH |
envs logout |
forget the sign-in here, and revoke it if the server allows |
envs whoami |
whether this machine is signed in, never the token itself |
envs team ls |
who the hosted catalog is shared with, and who shares one with you |
envs team invite |
print a one-use code; it carries network access only, so send the key separately |
envs team join <code> |
accept an invite on this machine |
envs team remove <member> |
end their access at once; rotate the key if they ever held it |
Two commands print values, and both say so.
export refuses without --yes, and
build refuses any key not classified low.
Everything else reports keys and sources and never a value.
Environment
ENVS_KEK |
the key, base64, 32 bytes |
ENVS_RECOVERY_CODE |
a recovery code, instead of the key |
ENVS_NO_GLOBAL |
ignore the machine-wide layer; CI should set this |
ENVS_CATALOG_PATH |
name the catalog explicitly |
ENVS_BACKUP_DIR |
where backup writes |
ENVS_SERVE_TOKEN |
bearer token for serve, 16 characters or more
|