Introduction

Getting Started

A quick introduction to managing your environment variables with Envless.

What is Envless?

Envless replaces local .env files with an end-to-end encrypted platform for syncing environment variables across your team, environments, and CI/CD pipelines. You manage variables in the dashboard; your apps and CI runners pull them down, decrypted only on your machine.

Three ways to use it

However your app loads configuration, Envless has a path:

Import in your app

import { env } from '@goenvless/env/server': typed by envless types, decrypted at boot with @goenvless/env/register, no .env files.

Sync to .env files

envless sync: encrypted pull, written to .env.<slug> for Docker, python-dotenv, Rails, shell.

Wrap a process

envless run -- npm start: inject into a single process, nothing on disk.

Five-minute path

Create an account

Sign up at envless.cloud/dashboard. Every account comes with a default workspace.

Create a product, a project and environments

From the dashboard, create a product, then a project inside it, then define environments, typically development, staging, and production.

Install Envless

bash
npm i -g @goenvless/cli@latest

The runtime is a second package. Install it in any project that imports env:

bash
npm i @goenvless/env

See Installation for per-project setup and other package managers.

Log in and link

bash
envless login
envless link
envless passphrase set

Pull variables

Pick the mode that fits your stack: runtime import, .env sync, or envless run --. The Using Variables section walks through each.

Running on machines?

CI runners, containers, and production hosts can't do the browser login. Set an ENVLESS_TOKEN (an ev_sk_ key from the dashboard) plus a decryption credential (ENVLESS_KEY or ENVLESS_PASSPHRASE), and point at a target with a committed .envless file or with ENVLESS_PROJECT and ENVLESS_ENV. Every read, including the runtime import, then works headlessly. The CLI treats a machine key as read only, so envless commands that create, change or delete anything still need envless login on that machine. That is a CLI rule rather than a property of the key: the same ev_sk_ key writes happily over the HTTP API and the SDKs for TypeScript and Python when you give it write scopes. See Keys and Production & CI.

What's next?

Concepts

How .envless, encryption, and environments fit together.

Server vs Client

Keep server secrets out of your client bundle.

Import in your app

The runtime ships as its own @goenvless/env package: typed env from /server, decrypted at boot with /register.

API & encryption

Read/write your workspace over HTTP, or from code with the TypeScript, Python, Ruby or PHP SDK, encrypting and decrypting on your side.

Going deeper

If you would rather see the whole shape of the product before you start, these walk through it.

Getting set up

Every step in the sequence and exactly what it writes to disk.

All features

One page per capability, with the real numbers and the limits.