Exports reference

Composer autoloads everything under the Envless namespace. The client is Envless\Envless, the helpers are static methods on it, and the rest are classes in a handful of sub-namespaces.

Clients#

Every client reads ENVLESS_TOKEN and ENVLESS_API_ENDPOINT for the arguments you leave out. See Create a client.

use Envless\Envless;

Envless::init(timeout: 10);

$page = Envless::getClient()->products->list();

echo $page->totalCount(), PHP_EOL;

Crypto#

They are plain synchronous calls: encryption is CPU work. See Encryption for the recipe and for why you should derive the key once when writing a batch.

Helpers#

rotateWorkspacePassphrase re-encrypts live variables and version history for one environment, which is the part that is easy to forget. verifyWebhookSignature is the receiver side of Webhooks and returns a WebhookEvent. variableNameValidation returns an Envless\Result\Validation without throwing, for checking a name in your own form or importer against the rule every write applies before it sends anything.

use Envless\Envless;

$check = Envless::variableNameValidation('1_PASSWORD');

if (!$check->valid) {
    echo $check->error, PHP_EOL;
}

Exceptions#

See Errors.

Results#

They are immutable, with readonly properties, and json_encode() turns each one into the same JSON as its TypeScript twin. Everything else the SDK returns is the decoded array.

HTTP#

Constants#

Enum-like values, so you never hard-code a string the API might reject. Each is a class of constants with an ALL array of every value, such as ScopeLevels::READ.

use Envless\Constants\ScopeLevels;
use Envless\Constants\ScopeResources;
use Envless\Constants\VariableVisibilityLevels;
use Envless\Envless;

$envless = new Envless();

$envless->keys->create([
    'name' => 'ci',
    'scopes' => [
        ScopeResources::VARIABLES => ScopeLevels::READ,
        ScopeResources::VERSIONS => ScopeLevels::READ,
    ],
]);

$passphrase = (string) getenv('ENVLESS_PASSPHRASE');
$workspaceId = $envless->me->get()['workspaceId'];

$envless->variables->create('web', 'production', [
    'name' => 'NEXT_PUBLIC_API_URL',
    'value' => Envless::encryptValue('https://api.acme.com', $passphrase, $workspaceId),
    'visibility' => VariableVisibilityLevels::CLIENT,
]);

Types#

Every request body and every response has an array shape on Envless\Types, named after its TypeScript twin, written as a @psalm-type that PHPStan reads too. Every method declares the shapes it takes and returns, so both tools check every key you send and read, and they cost nothing at runtime. Your own code can import them:

use Envless\Types;

/**
 * @psalm-import-type VariableResource from Types
 */
final class SecretsCache
{
    /** @param list<VariableResource> $variables */
    public function warm(array $variables): void {}
}

PHPStan reads @psalm-import-type as well as its own @phpstan-import-type, so one import works for both.

Pages and pagination#

Envless\Result\Page<T>, Envless\Result\ProductAccessPage, PaginationEnvelope

Resources#

IdentityResource, UserSummary, RoleSummary, ActorReference, ActorKeyReference, WorkspaceResource, CurrentWorkspaceResource, UpdatedWorkspaceResource, DeletedWorkspaceResource, CustomDomainResource, CustomDomainRecord, RemovedDomainResource, ProductResource, DeletedProductResource, ProductAccessEntry, GrantedProductAccessResource, RevokedProductAccessResource, ProjectResource, DeletedProjectResource, EnvironmentResource, EnvironmentSummaryResource, DeletedEnvironmentResource, VariableResource, DeletedVariableResource, DeletedVariablesResource, CreatedVariablesResource, VariableHistoryEvent, VersionResource, VersionDetailResource, VersionEntryResource, RolledBackVersionResource, ReencryptedEntriesResource, MemberResource, DeletedMemberResource, LeftWorkspaceResource, InviteResource, RevokedInviteResource, RoleResource, DeletedRoleResource, PermissionResource, PermissionsResource, KeyResource, CreatedKeyResource, DeletedKeyResource, WebhookResource, CreatedWebhookResource, DeletedWebhookResource, RotatedSecretResource, WebhookDeliveryResource, WebhookDeliveryDetailResource, RedeliveredWebhookResource, EventTypesResource

Inputs#

WorkspaceCreate, WorkspacePatch, ProductCreate, ProductPatch, ProjectCreate, ProjectPatch, EnvironmentCreate, EnvironmentPatch, VariableInput, VariablePatch, VersionCreate, MemberInvite, MemberPatch, RoleCreate, RolePatch, KeyCreate, KeyPatch, WebhookCreate, WebhookPatch, ApplyChanges, ApplyBaselineEntry, ApplyUpdateEntry, ApplyResult, ReencryptEntryInput

Crypto and webhooks#

EncryptionParameters, WebhookEvent, plus the Envless\Result\Validation, Envless\Result\RotationResult and Envless\Result\RotationIssue classes

Options are named arguments rather than types, so there is no ListOptions or RequestScope in PHP.

A worked example#

use Envless\Constants\ScopeLevels;
use Envless\Envless;

$envless = new Envless();
$passphrase = (string) getenv('ENVLESS_PASSPHRASE');
$workspaceId = $envless->me->get()['workspaceId'];
$key = Envless::deriveWorkspaceKey($passphrase, $workspaceId);

$product = $envless->products->create(['name' => 'Internal tools', 'slug' => 'internal-tools']);
$project = $envless->projects->create(['name' => 'API', 'slug' => 'api', 'product' => $product['slug']]);

foreach (['development', 'staging', 'production'] as $name) {
    $envless->environments->create($project['slug'], ['name' => $name, 'slug' => $name], product: $product['slug']);
}

$envless->variables->createMany('api', 'production', [
    ['name' => 'DATABASE_URL', 'value' => Envless::encryptWithKey($key, (string) getenv('DATABASE_URL'))],
    ['name' => 'PORT', 'value' => Envless::encryptWithKey($key, '3000'), 'type' => 'number'],
], product: $product['slug']);

$envless->versions->create('api', 'production', ['note' => 'Initial provisioning'], product: $product['slug']);

$runner = $envless->keys->create([
    'name' => 'api-runner',
    'scopes' => ['variables' => ScopeLevels::READ],
    'projectIds' => [$project['id']],
]);

echo $runner['secret'], PHP_EOL;