EnvShip CLI

EnvShip delivers encrypted .env bundles to CI, Docker, VPS, Laravel, Node, and other deployments. Humans set up workspaces, projects, bundles, channels, and access in the OAuth/passkey Dashboard. The CLI is the deploy and automation surface: connect trusted workstations, install scoped server identities, pull encrypted current bundles, and run processes without sending plaintext secrets to EnvShip.

Package name: @envshipcom/cli
Binary command: envship

Install

pnpm dlx @envshipcom/cli --help
npx @envshipcom/cli --help
npm install -g @envshipcom/cli

Quick Start

For workstation development, read, and edit access:

envship auth login
envship setup --workspace "Acme" --project "Acme Web" --bundle web --channels staging,production

For a one-off read-only server install:

envship machine install --name web-production --channel web/production
envship channel pull web/production --out .env --force
envship channel run web/production -- npm start

For CI, autoscaling, and fresh instance spin-ups:

envship machine deploy-token-create --project <project-id> --channel web/production
ENVSHIP_DEPLOY_TOKEN=edt_...
envship machine install --deploy-token "$ENVSHIP_DEPLOY_TOKEN" --name web-production
curl -fsSL "https://api.envship.com/v1/deploy-json?channel=web%2Fproduction&token=$ENVSHIP_DEPLOY_TOKEN"
envship channel pull web/production --out .env --force

Security Model

• OAuth proves account identity; it does not decrypt secrets by itself.
• Human browser editing unlocks with Authorized Devices and passkey-derived vault keys in the Dashboard.
• Browser Dashboard access is included with the signed-in account. CLI Workstations cover trusted coding environments like a laptop, desktop, dev container, or Codespace for development read/edit workflows.
• Server installs are project-scoped, read-only deploy identities, separate from human CLI Workstations.
• Machine seats are billed per online server. For autoscaling platforms such as AWS Elastic Beanstalk, each active fresh instance consumes one machine seat unless it reuses the same installed signing identity.
• If active machines exceed the workspace plan, EnvShip allows a 7-day upgrade grace before blocking new server installs. The recommended PayPal upgrade path is a separate difference subscription unless billing can be consolidated safely.
• Deployable tokens are deploy credentials for non-interactive server installs during CI, autoscaling, and fresh instance spin-ups. They are shown once, hashed server-side, scoped to allowed channels, revocable, rotatable, and audited.
• DirectJSON token links are the simplest read-only channel integration for systems that only need JSON metadata and public ciphertext URLs via curl; they use deployable tokens and are not another seat model.
• Runtime pulls prefer public encrypted current descriptors and immutable encrypted bundle objects from the EnvShip CDN. The public CDN contains ciphertext, hashes, and signed metadata only.
• EnvShip never receives plaintext dotenv values, private vault keys, passkey PRF outputs, vault unlock keys, private machine keys, or unwrapped bundle keys.

Commands

envship auth login

Creates a device approval code and opens the browser authorization URL.

envship auth login
envship auth login --headless

envship auth whoami and envship auth logout

Inspect or clear the local EnvShip session and server install credential.

envship auth whoami
envship auth logout

envship setup

Creates the first workspace, project, bundle, and channels for the signed-in session. Dashboard onboarding is the recommended path for production setup because it also walks humans through Authorized Devices and plan selection.

envship setup --workspace "My Workspace" --project "My First Project" --bundle web --channels staging,production

envship machine install

Installs a scoped, read-only server identity. Use interactive approval for one-off servers, or a deployable token for CI, autoscaling, and fresh instance spin-ups.

envship machine install --name github-actions-production --channel web/production
envship machine install --deploy-token "$ENVSHIP_DEPLOY_TOKEN" --name elastic-beanstalk-web

Inspect or revoke a server install:

envship machine status
envship machine revoke --yes
envship machine revoke --id 00000000-0000-0000-0000-000000000000 --yes

Deployable Tokens And DirectJSON

Create, list, revoke, or rotate reusable deployable tokens. Tokens are shown once; store them like any other production deploy credential. Use them with envship machine install --deploy-token for non-interactive server installs, or with DirectJSON links for the simplest read-only channel fetch.

envship machine deploy-token-create --project <project-id> --channel web/production
envship machine deploy-token-list --project <project-id>
envship machine deploy-token-revoke <token-id> --yes
envship machine deploy-token-rotate <token-id> --yes
curl -fsSL "https://api.envship.com/v1/deploy-json?channel=web%2Fproduction&token=$ENVSHIP_DEPLOY_TOKEN"

envship channel pull

Fetches the current encrypted channel, verifies signed hashes, decrypts locally with the installed server credential, and writes dotenv output.

envship channel pull web/staging --out .env --force
envship channel pull web/staging --out -

When the channel has a public encrypted descriptor, the CLI fetches the descriptor and bundle from the CDN path so runtime pulls do not hit Worker/D1 on every request. If the descriptor is unavailable in local/debug environments, the CLI falls back to the Worker pull route. Production runtime pulls always respect the CDN descriptor path; Dashboard Deploy History shows whether a saved encrypted version is runtime-ready or waiting for CDN refresh.

envship channel run

Runs a command with locally decrypted env values.

envship channel run web/production -- npm run deploy

Channel Inspection And Rollback

envship channel list
envship channel versions web/staging
envship channel rollback web/staging --version-id 00000000-0000-0000-0000-000000000000 --yes

Grants And Administration

envship grant create web/staging --keyset kst_example --preset editor
envship grant list web/staging
envship invite create --email [email protected] --role viewer
envship invite list
envship member list
envship project list
envship audit list
envship billing status
envship billing checkout --plan pro
envship doctor

Use --json on any command for machine-readable output. Commands that intentionally write decrypted dotenv data to stdout, such as envship channel pull --out -, cannot be combined with --json.

Configuration

EnvShip stores local CLI config at:

~/.envship/config.json

The config file may contain a session cookie, workstation identity, and server signing credential. It is written with owner-only permissions where the operating system supports them. Do not share it, paste it into support requests, or commit it.

Safe inspection:

envship config get
envship config get apiBaseUrl

envship config get redacts credential-bearing fields and only exposes safe config keys.

Useful environment variables:

• ENVSHIP_API_BASE_URL: API origin. Defaults to https://api.envship.com.
• ENVSHIP_APP_URL: browser app origin. Defaults to https://envship.com.
• ENVSHIP_SESSION: session cookie value for local tests or explicit automation.
• ENVSHIP_DEPLOY_TOKEN: deployable token for non-interactive server installs and DirectJSON read-only channel links.

Do not commit ENVSHIP_SESSION, ENVSHIP_DEPLOY_TOKEN, or ~/.envship/config.json.

Troubleshooting

• Channel web/staging was not found: run Dashboard setup or envship setup, then check that the server install is scoped to that channel.
• machine_not_configured: run envship machine install for a server install, or install with a deployable token.
• deploy_token_invalid: create or rotate a deployable token from a project manager/owner session.
• json_stdout_conflict: write decrypted dotenv output to a file, or omit --json when using --out -.
• envship doctor --json exits nonzero when readiness checks fail, while keeping stdout as one parseable JSON object.
• Encrypted bundle hash mismatch: EnvShip refused to decrypt because the fetched object did not match signed metadata.
• missing_publish_capability: your user or server install is not allowed to publish this channel.
• Local development should prefer --api-url http://127.0.0.1:8787 for CLI smoke checks. The CLI does not disable TLS verification globally.

npm Publish Checklist

1. Create or join the npm organization/scope envshipcom.
2. Run npm login.
3. Confirm package metadata in packages/cli/package.json.
4. Build: pnpm --filter @envshipcom/cli build.
5. Dry run: npm pack --dry-run from packages/cli.
6. Run package smoke from the repo root: pnpm smoke:cli-package.
7. Publish only after explicit approval: npm publish --access public from packages/cli.
8. Verify: https://www.npmjs.com/package/@envshipcom/cli.
9. Test from a clean directory: pnpm dlx @envshipcom/cli --help and npx @envshipcom/cli --help.