Install

npm i -g @boltenv.dev/cli

Or via curl:

curl -fsSL https://boltenv.dev/install | sh

Requires Node.js 22+.

Quick Start

# 1. Authenticate with GitHub
boltenv login

# 2. Push your .env (encrypted locally, uploaded as ciphertext)
boltenv push

# 3. Share the key with your teammate
boltenv key export
# → dGhpcyBpcyBhIDMyIGJ5dGUga2V5...

# Teammate imports the key and pulls
boltenv key import <base64-key>
boltenv pull

That's it. Your teammate now has the same .env — decrypted on their machine, never visible to the server.

Why boltenv

Your .env is the most important file in your project, and you're sharing it via Slack DMs.

| What you do today | What happens | |---|---| | Slack the .env | Plaintext in a chat log forever | | .env.example with fake values | Half the keys are wrong by Tuesday | | Copy from prod "carefully" | Someone copies the wrong DB and deletes users |

boltenv: encrypted on your machine, decrypted on theirs. The server never sees plaintext.

How It Works

  Your Machine                   boltenv Cloud                  Teammate's Machine
  ┌──────────┐                  ┌──────────────┐               ┌──────────────┐
  │ .env file │── AES-256-GCM ─>│  Encrypted   │── Decrypt ──>│  .env file   │
  │ (secrets) │   on YOUR       │  blob only   │   locally     │  (secrets)   │
  └──────────┘   machine        └──────────────┘               └──────────────┘

1. Push — CLI encrypts your .env locally, uploads only the ciphertext
2. Pull — CLI downloads ciphertext, decrypts locally with your key
3. Auth — GitHub repo access = env access. No new accounts.

Commands

boltenv login                   # Authenticate with GitHub
boltenv push                    # Encrypt & upload your .env
boltenv pull                    # Download & decrypt .env
boltenv ls                      # Version history & metadata
boltenv whoami                  # Show current user & repo

Push

boltenv push                    # Push .env from current directory
boltenv push .env.production    # Push a specific file
boltenv push -e production      # Push to a specific environment
boltenv push -y                 # Skip confirmation prompt

Pull

boltenv pull                    # Pull .env to current directory
boltenv pull -e staging         # Pull from a specific environment
boltenv pull --version 3        # Pull a specific version (rollback)
boltenv pull --format json      # Output as JSON
boltenv pull --stdout           # Print to stdout (pipe anywhere)

Version History

$ boltenv ls

  myorg/myapp:development

  Keys    12
  TTL     permanent
  Latest  alice pushed 5 min ago

   * v3               12 keys             alice            5 min ago
   . v2               10 keys             bob              2 days ago
   . v1                8 keys             alice            1 week ago

Key Management

boltenv key export              # Get your key as base64 (share securely)
boltenv key import <base64>     # Import a teammate's key
boltenv key status              # Check if you have the key for this repo

Environments

boltenv auto-detects the environment from your git branch:

| Branch | Environment | |---|---| | main, master | production | | staging | staging | | develop, development | development | | anything else | development |

Override with -e:

boltenv push -e production
boltenv pull -e staging

CI/CD

# Set these in your CI environment:
export BOLTENV_TOKEN=ghp_xxx           # GitHub PAT with repo scope
export BOLTENV_KEY=base64-key-here     # From: boltenv key export
export BOLTENV_REPO=myorg/myapp        # Skip git detection

# Pull in CI
boltenv pull -y

Security

| | | |---|---| | Encryption | AES-256-GCM (NIST standard) | | Key derivation | HKDF-SHA256 (separate subkeys for encryption and HMAC) | | IV | 12 bytes, random per push | | Auth tag | 16 bytes (tamper detection) | | Server sees | Ciphertext + key fingerprint only | | Key stored at | ~/.boltenv/keys/{owner}/{repo}.key (0o600) |

The encryption key is generated locally and never transmitted. The server cannot decrypt your data.

Requirements

• Node.js 22+
• Git repo with a GitHub remote
• GitHub account with repo access