Everything, without leaving the terminal

One binary and 24 commands covering the whole product surface. Encryption and decryption happen on your machine, so the passphrase never leaves the device and a locked workspace fails before anything is sent.

What the CLI is for

The Envless CLI is the primary way developers use Envless day to day. You authenticate once with a browser device flow, bind a directory to a workspace and environment, and from then on every command reads and writes encrypted values with a key derived and cached locally. It covers the whole product, not just reads: products, projects, environments, variables, versions, members, roles, access grants and domains all have subcommands, and every list can emit JSON so it composes with the rest of your tooling.

The surface, measured

Counted from the command registration table, not from the README.

24 / 54

Commands and subcommands

Twenty-four top-level commands expose fifty-four subcommands between them. Familiar aliases are remapped before dispatch, so ls, rm, add, copy, rollback, edit and log all land where you would expect.
0700 / 0600

Config directory and file modes

Credentials live in ~/.envless/config.json. The directory is created 0700 and the file written 0600, atomically through a temp file and a rename, so nothing ever lands with your default umask.
6 characters

Device login code

Drawn from a 32-symbol alphabet that omits I, O, 0 and 1 so it can be read aloud without ambiguity. The code expires in five minutes, and the session token it mints is stored server-side only as a hash.
90 days

CLI session lifetime

Each login emits a workspace webhook carrying hostname, OS, architecture and CLI version, and the resulting device session appears in the dashboard where it can be revoked without touching the others.
read only

Machine keys in the CLI

Every write path refuses an ev_sk_ token and tells you to run envless login. That is a CLI-side rule: the same key writes happily over the HTTP API when it carries write scopes.
128 + n

Exit code when a child is signalled

envless run inherits stdio, drops its own signal handlers, forwards SIGINT and SIGTERM to the child, and exits with the child's own code, so it composes correctly inside CI and process managers.

A working session, start to finish

Install, authenticate, bind the directory, then pick a delivery mode. Everything after the first two steps is repeatable and non-interactive.

  1. 1

    Install and sign in

    The device flow prints a short code and opens your browser. Nothing is typed into the terminal, so the CLI never handles your account password.

    npm i -g @goenvless/cli@latest
envless login
  2. 2

    Bind the directory and unlock

    link writes a .envless file that is safe to commit, and passphrase set derives the workspace key locally and verifies it against real ciphertext before caching it at mode 0600. You do this once per workspace, per machine.

    envless link
envless passphrase set
envless whoami
  3. 3

    Run your app with secrets injected

    No file is written, so nothing can be committed by accident. Pass more than one environment and they merge left to right, with the later one winning a name collision.

    envless run -- npm start
envless run --env production -- node server.js
envless run --env staging,development -- npm test
  4. 4

    Manage variables and versions inline

    Values are encrypted before the request is sent, so a locked workspace fails immediately rather than transmitting plaintext. Reading a secret from stdin keeps it out of your shell history.

    envless var set STRIPE_KEY=sk_live_123
cat key.pem | envless var set TLS_KEY --stdin
envless publish "shipping v2"
envless version restore v11 --env production --yes
  5. 5

    Script it

    Every list command takes --json, and every destructive command takes --yes so it can run unattended. NO_COLOR and FORCE_COLOR=0 both strip ANSI codes when the output is going somewhere that is not a terminal.

    envless project list --json
envless role permissions --json
envless product delete billing --yes
  6. 6

    Sign out and leave nothing behind

    logout revokes the session server-side and clears the local config and the entire cache directory, so a shared or borrowed machine keeps none of your workspace state.

    envless logout
envless passphrase clear --all

Read the details

Every command has a reference page with its flags, its failure modes, and what it writes where.

The CLI FAQ

Straight answers about how this works in practice.

Mostly no, and it is better to be blunt about it. sync, run, build, types, var and push all fetch from the API and fail hard when it is unreachable. The two exceptions are whoami, which falls back to the cached profile with a warning, and logout, which clears your local state regardless. If you need a process to survive an outage, that is the in-process runtime package, which reads its own on-disk ciphertext cache.

In ~/.envless/config.json, written at mode 0600 inside a directory created at 0700, through a temp file and a rename so a crash cannot leave a partial file with loose permissions. It holds the session token and the derived workspace keys. envless logout clears it along with the whole cache directory.

Yes, and that is the intended path. Set ENVLESS_TOKEN to a machine key and supply a decryption credential, either ENVLESS_KEY for the raw exported workspace key or ENVLESS_PASSPHRASE, then point at a target with a committed .envless file or with ENVLESS_PROJECT and ENVLESS_ENV. Prefer ENVLESS_KEY on machines: it skips key derivation entirely and keeps a human-chosen string out of your pipeline.

It is a deliberate CLI-side guard: an unattended token that can silently mutate production variables is a bad default for a build step. The same ev_sk_ key does write over the HTTP API and the SDK when you give it write scopes, so the capability exists where you have opted into it explicitly.

None. pull is registered as a literal alias of the same handler, so the two cannot drift apart. Both write .env.<slug> files to disk. Note that neither prints variables to stdout, so redirecting the output with a shell pipe gives you a file full of status text rather than your secrets.

No. It decrypts in memory and spawns the child with the values in its environment, which is the whole reason to prefer it over sync. The only on-disk artefact in the picture is the runtime package's ciphertext cache, and even that never holds a decrypted value.

Set NO_COLOR or FORCE_COLOR=0. Both strip ANSI codes from every command, which is what you want when output is being captured into a CI log or piped into another tool.

Explore the rest of Envless

Every capability, broken down the same way.

Agents

AI agents

Give a coding agent working secrets with no plaintext .env in the repository for it to read or commit.

 TypeScript

The SDK

Zero-dependency typed client, full API coverage enforced by CI, with encryption and webhook helpers.

 Encryption

End-to-end encryption

AES-256-GCM on your machine, a key the server never sees, and an API that structurally refuses plaintext.

 History

Versioning and history

Numbered snapshots in one locked transaction, attributed per-variable history, and signed events for every change.

 Teams

Team access control

44 permissions, custom roles, private products isolated to named members, and keys clamped to their creator.

 Environments

Environment variables

Typed, per-environment variables with server/client splitting, .env import and export, and a real diff.

 Public feeds

Virtual environments

Serve an environment as an encrypted JSON feed at a public URL that needs no SDK, CLI or API key.

 Setup

Getting set up

Install, sign in, bind the directory, unlock, run. What each step writes, and what it does not.

 Cloning

One-click duplicate

Clone an environment, project or whole product with every variable, in one transaction, without decrypting anything.
Get Started

Ship secrets, not chaos.

Start free today and discover why developers trust Envless for end-to-end encrypted, versioned secrets across every environment.