bundle add envless-sdkgem install envless-sdkThe gem is envless-sdk, you load it with require "envless/sdk", and everything it defines lives under the Envless module. The envless name on RubyGems belongs to an unrelated project, so gem install envless installs something else entirely. That gem also ships its own lib/envless.rb, which is why this one loads from envless/sdk.
gem "envless-sdk"Requirements
| Ruby | 3.2 or newer |
| Dependencies | None at runtime. net/http, openssl and json come from the standard library |
| Concurrency | One client is safe to share between threads, and keeps working after a fork |
| Type checkers | Steep, from the RBS signatures the gem ships in sig/ |
The gem is pure Ruby, so it installs the same on every platform. The encryption runs on the OpenSSL your Ruby was built with, which provides AES-256-GCM and PBKDF2 on every supported version.
envless-sdk administers a workspace. It does not load variables into your app. A Rails or Rack service loads them with the Ruby runtime, envless-env, or reads its configuration from ENV once envless run -- bin/rails server or envless run -- bundle exec puma has decrypted the environment into the process, or from a .env file written by envless sync.
Verify the install
me.get is the only method with no scope requirement, which makes it the cheapest way to prove a credential is live before you build anything on it.
require "envless/sdk"
identity = begin
Envless.me.get
rescue Envless::ApiError => error
if error.auth?
warn "The API key is invalid, inactive or revoked, " \
"or its owner left the workspace."
end
raise
end
puts "Authenticated as #{identity[:user][:email]}"
puts "Workspace #{identity[:workspaceId]}"Every one of those failures comes back as HTTP 401 carrying an error code under auth., which is exactly what auth? tests. 403 with auth.scope_missing cannot happen here, because this endpoint is the one route that carries no scope middleware.
The installed version is Envless::VERSION, and the same string is the User-Agent suffix every request carries, envless-sdk-ruby/<version>.
Get an API key
Open the dashboard
Open Keys in the sidebar, under the workspace group. It is a top level page at /dashboard/keys, not part of Settings.
Create a key with the narrowest scopes that work
Scopes are per resource and per level, such as variables:read or projects:write. Grant only what the script needs. See Authentication.
Copy the secret immediately
The ev_sk_... value is shown exactly once and is unrecoverable. Reads afterwards only ever expose the non-secret prefix.
Store it as ENVLESS_TOKEN
Envless::Client.new, Envless.init and the shared client behind Envless.variables and the other namespaces all fall back to that variable, so you can call them with no arguments. Set it and you can skip init entirely: the first method call builds the client for you.
An API key is bound to the workspace it was created in, and unless you pin it to a list of projectIds it reaches every project in that workspace. Keep it in a secret store or an environment variable, never in source control, and never in Rails credentials you commit unencrypted.