envshare CLI

The envshare CLI is the primary interface for pushing, sharing, pulling, auditing, and administering encrypted environment variables.

Install and run

Install the CLI in the project that owns the environment variables:

npm install --save-dev @envshare/cli
npx envshare --help

Because the CLI is installed locally, run it through the package manager (npx envshare, pnpm exec envshare, or equivalent). A bare envshare command is only available after a global install or a custom shell PATH.

envshare init writes .envshare/config.json at the Git root. That file stores the envshare project id and default env file for the repo, so follow-up commands can run from the project without --project. It does not contain tokens, private keys, or secret values. Existing global project selections are not used for project commands; run npx envshare init once in each repo.

npx envshare login
npx envshare init
npx envshare push --all
npx envshare pull

You can still run the published CLI without installing it into a project:

npx @envshare/cli@latest --help

Usage

npx envshare login
npx envshare init
npx envshare project list
npx envshare project use
npx envshare project create --repo-owner acme --repo-name api --file .env.local
npx envshare push --all
npx envshare share --to [email protected] --expires 24h --keys DATABASE_URL,STRIPE_SECRET_KEY
npx envshare pull

Use envshare init --select or envshare project use <project> when the envshare project already exists. Project selectors accept the project id, owner/repo, or a unique repo name. Use envshare project create when you need to create or update the selected project explicitly instead of relying on Git remote detection during init. Use pull --source-file <file> --file <target> when the stored env-file scope and local output file are different.

npx envshare login opens a browser for GitHub authentication and, when possible, returns to a temporary local 127.0.0.1 callback. The CLI stores the resulting session token in the OS keychain after a PKCE-protected exchange; the browser redirect never carries the long-lived token.