composer require envless/sdkThe package is envless/sdk on Packagist, everything it defines lives under the Envless namespace, and the client is Envless\Envless. Composer's autoloader loads it, so the require 'vendor/autoload.php'; your entry point already has is all the setup there is.
Requirements
| PHP | 8.2 or newer |
| Extensions | curl, json and openssl, which almost every PHP build ships with |
| Dependencies | None. Composer installs nothing else |
| HTTP | cURL by default, or Guzzle and any other PSR-18 client through Envless\Http\Psr18HttpClient |
| Type checkers | PHPStan and Psalm, from the array shapes on Envless\Types |
The package is plain PHP, so it installs the same everywhere Composer runs. The encryption runs on the OpenSSL your PHP was built with, which provides AES-256-GCM and PBKDF2 on every supported version.
envless/sdk administers a workspace. It does not load variables into your app. A Laravel, Symfony or plain PHP app loads them with the PHP runtime, envless/env, or reads its configuration from the environment once envless run has decrypted it into the process, or from a .env file written by envless sync.
Verify the install
$envless->me->get() is the only method with no scope requirement, which makes it the cheapest way to prove a credential is live before you build anything on it.
use Envless\Envless;
use Envless\Exception\ApiException;
$envless = new Envless();
try {
$identity = $envless->me->get();
} catch (ApiException $error) {
if ($error->isAuth()) {
fwrite(STDERR, 'The API key is invalid, inactive or revoked, or its owner left the workspace.' . PHP_EOL);
}
throw $error;
}
echo 'Authenticated as ', $identity['user']['email'], PHP_EOL;
echo 'Workspace ', $identity['workspaceId'], PHP_EOL;Every one of those failures comes back as HTTP 401 carrying an error code under auth., which is exactly what isAuth() tests. 403 with auth.scope_missing cannot happen here, because this endpoint is the one route that carries no scope middleware.
The installed version is Envless\Envless::VERSION, and the same string is the User-Agent suffix every request carries, envless-sdk-php/<version>.
Get an API key
Open the dashboard
Open Keys in the sidebar, under the workspace group. It is a top level page at /dashboard/keys, not part of Settings.
Create a key with the narrowest scopes that work
Scopes are per resource and per level, such as variables:read or projects:write. Grant only what the script needs. See Authentication.
Copy the secret immediately
The ev_sk_... value is shown exactly once and is unrecoverable. Reads afterwards only ever expose the non-secret prefix.
Store it as ENVLESS_TOKEN
new Envless(), Envless::init() and Envless::getClient() all fall back to that variable, so you can build a client with no arguments.
An API key is bound to the workspace it was created in, and unless you pin it to a list of projectIds it reaches every project in that workspace. Keep it in a secret store or an environment variable, never in source control, and never in a .env file you commit.