pip install envless-sdkuv add envless-sdkpoetry add envless-sdkThe package installs as envless-sdk and imports as envless. The plain envless name on PyPI belongs to an unrelated project that also ships a module called envless, so pip install envless installs something else entirely, and having both installed makes import envless ambiguous.
Requirements
| Python | 3.10 or newer |
| Dependencies | httpx, anyio, cryptography and typing-extensions |
| Async runtimes | asyncio and trio, through anyio |
| Type checkers | mypy and pyright, from the bundled py.typed and TypedDict stubs |
The package is pure Python, so a single wheel serves every platform. cryptography is the only dependency with compiled code, and it publishes wheels for Linux, macOS and Windows on the common architectures, so a normal install builds nothing.
envless-sdk administers a workspace. It does not load variables into your app. A Python service loads them with the Python runtime, envless-env, or reads them from os.environ once envless run -- python app.py or envless run -- gunicorn app:app has decrypted the environment into the process, or from a .env file written by envless sync.
Verify the install
me.get() is the only method with no scope requirement, which makes it the cheapest way to prove a credential is live before you build anything on it.
from envless import EnvlessApiError, envless
try:
identity = envless.me.get()
except EnvlessApiError as error:
if error.is_auth:
print('The API key is invalid, inactive, revoked, or its owner left the workspace.')
raise
print(f"Authenticated as {identity['user']['email']}")
print(f"Workspace {identity['workspaceId']}")Every one of those failures comes back as HTTP 401 carrying an error code under auth., which is exactly what is_auth tests. 403 with auth.scope_missing cannot happen here, because this endpoint is the one route that carries no scope middleware.
The installed version is envless.__version__, and the same string is the User-Agent suffix every request carries, envless-sdk-python/<version>.
Get an API key
Open the dashboard
Open Keys in the sidebar, under the workspace group. It is a top level page at /dashboard/keys, not part of Settings.
Create a key with the narrowest scopes that work
Scopes are per resource and per level, such as variables:read or projects:write. Grant only what the script needs. See Authentication.
Copy the secret immediately
The ev_sk_... value is shown exactly once and is unrecoverable. Reads afterwards only ever expose the non-secret prefix.
Store it as ENVLESS_TOKEN
Envless(), AsyncEnvless(), init() and the ready made envless client all fall back to that variable, so you can call them with no arguments. Set it and you can skip init entirely: the first method call on envless builds the client for you.
An API key is bound to the workspace it was created in, and unless you pin it to a list of projectIds it reaches every project in that workspace. Keep it in a secret store or an environment variable, never in source control, and never in a client a browser downloads.