Everything Envless does

Secrets are encrypted and decrypted on your machines, the server only ever holds ciphertext.

• Client-side AES-256-GCM encryption

  Variable values are encrypted with AES-256-GCM using a key derived from the workspace passphrase via PBKDF2-SHA256 (200,000 iterations) with a workspace-specific salt. Encryption and decryption happen only on client machines.

• Zero-knowledge server storage

  The server stores only ciphertext and never sees plaintext values or the workspace passphrase. Decryption requires the locally cached derived key.

• Workspace passphrase management

  Set, verify, rotate, and clear workspace encryption passphrases. The CLI verifies a passphrase against sample encrypted variables before caching the derived key, and supports rotating or forgetting keys from the dashboard.

• Encryption SDK

  The @goenvless/sdk package exposes encryptValue(), decryptValue(), deriveWorkspaceKey(), importWorkspaceKey(), and passphraseStrength(), and the Python and Ruby SDKs, both envless-sdk, the same helpers in snake_case, so you can encrypt values client-side before writing them through the API.

Get decrypted variables into any process, file, or runtime, without committing .env files.

• Typed runtime import

  Import environment variables directly in application code via the typed SDK, with automatic type coercion and no .env files on disk.

• Sync to .env files

  envless sync decrypts variables and writes .env.<environment-slug> files with proper bash escaping and a sync timestamp header. Writes are idempotent, unchanged files are skipped to avoid spurious dev-server reloads.

• Process wrapping (envless run)

  Inject decrypted variables into a single child process with no disk footprint and no code changes. Forwards SIGINT/SIGTERM to the child and returns its exit code, making it ideal for CI and one-off commands.

• Multi-environment merging

  envless run and envless build merge several environments into one process, with later environments winning on a name collision. Sync does not merge: it writes a separate .env.<slug> file per environment.

• Real process.env compatibility

  Envless populates the standard process.env alongside the typed env proxy, so libraries that read environment variables directly keep working.

• Project linking (.envless file)

  Bind a directory to a workspace, product, project, and one or more environments via interactive or flag-driven CLI. The resulting .envless JSON file is safe to commit and enables non-interactive sync and run.

Schema-driven types, compile-time checks, and guardrails that keep secrets out of client bundles.

• Typed variables with auto coercion

  Define variable schemas in the dashboard with required/optional flags and defaults. The CLI generates type-safe imports and coerces values to strings, numbers, or booleans at runtime.

• Type declaration generation

  envless types generates an envless-env.d.ts declaration file from the dashboard schema, giving IDE autocomplete and compile-time type checking.

• Server vs client variable splitting

  Visibility flags separate server-only and client-safe variables, enforced through types, runtime checks, bundler plugins, and ESLint rules to prevent secrets from leaking into client bundles.

• Test overrides

  Override env values in tests with __override() and scoped 'using' declarations, without mutating global state.

• Interactive CLI

  Guided workspace, project, and environment selection with autocomplete and validation, plus help/version flags, browser-based login, and an optional background npm update check.

First-class adapters for the runtimes and deploy targets developers actually use.

• Next.js integration

  The withEnvless() build plugin handles client inlining and runtime loading with full support for the App Router, Pages Router, and Edge Runtime.

• Vite plugin

  A Vite plugin for SPAs, SvelteKit, Remix-on-Vite, and other Vite-based frameworks with client variable inlining and dev-mode HMR.

• Node.js and Bun support

  Side-effect import (/register) or --import flag for Express, Fastify, Hono, and standalone scripts, plus native Bun support via a bunfig.toml preload hook with native crypto and faster cold starts.

• Edge worker support

  The withEnvless and Vite plugins inline client-flagged variables into the bundle at build time for Cloudflare, Vercel, and Netlify edge runtimes, and a separate @goenvless/env/edge entry loads them explicitly where a filesystem is not available.

• CI/CD and deploy targets

  Works with GitHub Actions, GitLab CI, CircleCI, and generic runners via ENVLESS_TOKEN, plus Vercel, Docker build secrets, Kubernetes (including the ExternalSecret operator), Fly.io, Railway, and Render.

Fast, resilient access to secrets even under cold starts or network failure.

• On-disk encrypted caching

  Ciphertext is cached on disk per workspace and environment exactly as the API returned it, at file mode 0600, and refetched once the 15-minute freshness window lapses. No plaintext value is ever written to the cache.

• Build-time inlining on edge

  On edge runtimes the envless build command inlines client-flagged variables at build time, so there is no fetch and no decryption on the request path.

• Cache management

  envless cache clear drops the cached ciphertext for the current product, project, and environment, and envless cache clear --all wipes the whole cache directory to force a fresh API fetch.

• Offline fallback

  envless whoami falls back to the cached profile with a warning when the API is unreachable, and the in-process runtime serves a fresh on-disk cache without a network call.

Every change is snapshotted, attributed, and reversible.

• Variable versioning and history

  Publish environment snapshots with version notes and view full change history, including who changed what and when. Add, update, and delete operations are all tracked.

• Version rollback

  Roll an environment back to a previous variable snapshot from the API or dashboard.

• Per-variable change history

  Track each variable's individual history with event types (created, updated, deleted, restored) and timestamps, with search and sorting in the dashboard.

• Workspace activity trail

  Every workspace action is recorded with actor information (user ID, name, email), event type, and payload, and is delivered in real time as a signed webhook. Per-variable history is queryable through the API and the dashboard; a workspace-wide query endpoint is not exposed yet.

Granular roles, scoped keys, and team management across isolated workspaces.

• Role-based access control

  Built-in Owner, Admin, and Viewer roles plus custom roles with fine-grained control across 45 granular permissions covering every resource.

• Scoped API keys

  Named, rotatable keys (ev_sk_...) with per-resource scopes (workspace, projects, environments, variables, versions, members) at read, write, or none levels. Keys are stored as SHA-256 hashes with usage and last-used tracking.

• Team invitations and member management

  Invite members by email with role assignment, resend or revoke pending invites (3-day expiration), update roles, and remove members or self-leave, all tracked via webhooks.

• Multi-tenant workspaces

  Create, switch between, and leave isolated workspaces, each with its own settings, icon, plan, projects, and environments.

• Project locking

  Lock a project to prevent accidental edits; locked projects show a warning banner and disable edit operations.

A complete programmatic surface with signed events and flexible sign-in.

• REST API with full CRUD

  HTTP API covering workspaces, projects, environments, variables, members, versions, and keys, with encrypted variable values, pagination, and sorting.

• Bulk variable operations

  Create or delete many variables in a single call, emitting bulk_created and bulk_deleted events.

• Signed webhooks

  Real-time JSON webhooks for 48 workspace event types, signed with HMAC-SHA256 per the Standard Webhooks spec, with at-least-once delivery, 5 exponential-backoff retries, per-endpoint secrets, secret rotation, and delivery history with manual redelivery.

• CLI device-code authentication

  Browser-based OAuth device flow for passwordless CLI login. Tokens are cached locally in ~/.envless/config.json (mode 0600) and can be revoked from the dashboard or via envless logout.

• Multi-provider sign-in

  Authenticate via email, Google OAuth, GitHub OAuth, or email one-time passwords (OTP) with expiration.

• Optional TOTP second factor

  Per-user two-factor authentication with any RFC 6238 authenticator app: SHA1, 6 digits, a 30 second period, and one step of clock drift accepted. Enrolment needs both an app code and an emailed code before it takes effect, and issues 10 single-use recovery codes stored as SHA-256 hashes. It is enforced in the API rather than the dashboard, bound to the sign-in it was verified against, and lasts 30 days or until the next sign-in. Off by default, with no workspace-wide requirement, and it does not apply to CLI tokens or API keys.

• Step-up verification

  43 endpoints require a fresh verification before they run, in the dashboard and in the CLI, covering credential changes, access changes, destructive deletes, bulk variable writes, key rotation, and account-level actions. Answer with a six-character emailed code, or an authenticator or recovery code if the second factor is on, and stay elevated for an hour. Not enforced on the public API-key surface.

• Billing and subscriptions

  Plan tiers (Free, Dev, Team) with monthly or yearly billing via Polar, customer portal access, invoice history, and plan-based resource limits.