Envless::Env.fetch_environment is the explicit loader, the Ruby twin of @goenvless/env/edge. Everything it needs arrives as a keyword, and it returns a plain Hash of decrypted values. It reads no .envless file and no CLI config, writes no cache, leaves ENV and Envless.env untouched, and memoises nothing, so every call fetches and decrypts again.

ruby

require "json"
require "envless/env"

VALUES = Envless::Env.fetch_environment(
  token: ENV.fetch("ENVLESS_TOKEN"),
  project: "checkout-api",
  environment: "production",
  key: ENV.fetch("ENVLESS_KEY")
)

def handler(event:, context:)
  {statusCode: 200, body: VALUES.fetch("PUBLIC_GREETING")}
end

Loading at file level, as above, pays the fetch once per cold start, and every invocation of a warm function reuses the Hash.

Keyword	Required	Purpose
`token:`	✅	An `ev_sk_` machine key
`project:`	✅	The project slug
`environment:`	✅	The environment slug
`product:`		The product slug, when the project slug exists in more than one product
`key:`	one of the two	The base64url raw workspace key. Checked first, so it wins when both are passed
`passphrase:`	one of the two	The workspace passphrase. The workspace is looked up over the API to derive the key
`workspace_id:`		Skips that lookup on the passphrase path
`endpoint:`		Overrides the API base URL
`adapter:`		An HTTP adapter for the requests, the same interface the Ruby SDK takes

Each missing input raises Envless::Env::LoadError naming what to pass:

txt

Pass a machine key as token:. A side-effect-free load reads no .envless file and no config.
Pass project: and environment:. A side-effect-free load has no .envless file to resolve them from.
Pass passphrase: or key:. Without one the values cannot be decrypted.
The workspace could not be resolved, so the passphrase cannot be turned into a key. Pass workspace_id: explicitly.

A value that will not decrypt fails naming it, Could not decrypt STRIPE_SECRET, and an API failure raises with the API's own message. The Hash holds every variable with no visibility filter and no coercion, so treat all of it as server secrets.

If your platform gives the function a writable home folder and you would like the cache, Envless::Env.load works in serverless functions too, with the same environment variables as anywhere else. fetch_environment is for when you want nothing read from or written to the machine.