Everything, without leaving the terminal

One binary, 24 commands, the whole product. Encryption runs on your machine, so the passphrase never leaves it.

Try nowOpen dashboardRead the docs

The surface, measured

The CLI is the primary way developers use Envless. Authenticate once through the browser, and every command reads and writes encrypted values with a locally derived key.

Full definition

The Envless CLI is the primary way developers use Envless day to day. You authenticate once with a browser device flow, bind a directory to a workspace and environment, and from then on every command reads and writes encrypted values with a key derived and cached locally. It covers the whole product, not just reads: products, projects, environments, variables, versions, members, roles, access grants and domains all have subcommands, and every list can emit JSON so it composes with the rest of your tooling.

  • Commands and subcommands

    24 / 54

    Twenty-four top-level commands expose fifty-four subcommands between them. Familiar aliases are remapped before dispatch, so ls, rm, add, copy, rollback, edit and log all land where you would expect.

  • Config directory and file modes

    0700 / 0600

    Credentials live in ~/.envless/config.json. The directory is created 0700 and the file written 0600, atomically through a temp file and a rename, so nothing ever lands with your default umask.

  • Device login code

    6 characters

    Drawn from a 32-symbol alphabet that omits I, O, 0 and 1 so it can be read aloud without ambiguity. The code expires in five minutes, and the session token it mints is stored server-side only as a hash.

  • CLI session lifetime

    90 days

    Each login emits a workspace webhook carrying hostname, OS, architecture and CLI version, and the resulting device session appears in the dashboard where it can be revoked without touching the others.

  • Machine keys in the CLI

    read only

    Every write path refuses an ev_sk_ token and tells you to run envless login. That is a CLI-side rule: the same key writes happily over the HTTP API when it carries write scopes.

  • Exit code when a child is signalled

    128 + n

    envless run inherits stdio, drops its own signal handlers, forwards SIGINT and SIGTERM to the child, and exits with the child's own code, so it composes correctly inside CI and process managers.

A working session, start to finish

  1. 1

    Install and sign in

    The device flow prints a short code and opens your browser. Nothing is typed into the terminal, so the CLI never handles your account password.

    npm i -g @goenvless/cli@latest
envless login
  2. 2

    Bind the directory and unlock

    link writes a .envless file that is safe to commit, and passphrase set derives the workspace key locally and verifies it against real ciphertext before caching it at mode 0600. You do this once per workspace, per machine.

    envless link
envless passphrase set
envless whoami
  3. 3

    Run your app with secrets injected

    No file is written, so nothing can be committed by accident. Pass more than one environment and they merge left to right, with the later one winning a name collision.

    envless run -- npm start
envless run --env production -- node server.js
envless run --env staging,development -- npm test
  4. 4

    Manage variables and versions inline

    Values are encrypted before the request is sent, so a locked workspace fails immediately rather than transmitting plaintext. Reading a secret from stdin keeps it out of your shell history.

    envless var set STRIPE_KEY=sk_live_123
cat key.pem | envless var set TLS_KEY --stdin
envless publish "shipping v2"
envless version restore v11 --env production --yes
  5. 5

    Script it

    Every list command takes --json, and every destructive command takes --yes so it can run unattended. NO_COLOR and FORCE_COLOR=0 both strip ANSI codes when the output is going somewhere that is not a terminal.

    envless project list --json
envless role permissions --json
envless product delete billing --yes
  6. 6

    Sign out and leave nothing behind

    logout revokes the session server-side and clears the local config and the entire cache directory, so a shared or borrowed machine keeps none of your workspace state.

    envless logout
envless passphrase clear --all

The CLI FAQ

Mostly no, and it is better to be blunt about it. sync, run, build, types, var and push all fetch from the API and fail hard when it is unreachable. The two exceptions are whoami, which falls back to the cached profile with a warning, and logout, which clears your local state regardless. If you need a process to survive an outage, that is the in-process runtime package, which reads its own on-disk ciphertext cache.

In ~/.envless/config.json, written at mode 0600 inside a directory created at 0700, through a temp file and a rename so a crash cannot leave a partial file with loose permissions. It holds the session token and the derived workspace keys. envless logout clears it along with the whole cache directory.

Yes, and that is the intended path. Set ENVLESS_TOKEN to a machine key and supply a decryption credential, either ENVLESS_KEY for the raw exported workspace key or ENVLESS_PASSPHRASE, then point at a target with a committed .envless file or with ENVLESS_PROJECT and ENVLESS_ENV. Prefer ENVLESS_KEY on machines: it skips key derivation entirely and keeps a human-chosen string out of your pipeline.

It is a deliberate CLI-side guard: an unattended token that can silently mutate production variables is a bad default for a build step. The same ev_sk_ key does write over the HTTP API and the SDK when you give it write scopes, so the capability exists where you have opted into it explicitly.

None. pull is registered as a literal alias of the same handler, so the two cannot drift apart. Both write .env.<slug> files to disk. Note that neither prints variables to stdout, so redirecting the output with a shell pipe gives you a file full of status text rather than your secrets.

No. It decrypts in memory and spawns the child with the values in its environment, which is the whole reason to prefer it over sync. The only on-disk artefact in the picture is the runtime package's ciphertext cache, and even that never holds a decrypted value.

Set NO_COLOR or FORCE_COLOR=0. Both strip ANSI codes from every command, which is what you want when output is being captured into a CI log or piped into another tool.

Next

The SDKs

Typed clients for TypeScript, Python, Ruby and PHP, full API coverage checked before every release, with encryption and webhook helpers.