Envoy CLI

🔐 Secure secret management with end-to-end encryption

Envoy is a command-line tool for managing environment variables and secrets with end-to-end encryption. Push your secrets once, pull them anywhere.

Features

✅ End-to-End Encryption - Your secrets are encrypted before leaving your machine
✅ Team Collaboration - Securely share secrets with your team
✅ Git Integration - Automatically detects your repository
✅ Zero-Knowledge - We can't read your secrets, even if we wanted to
✅ RepoKey Support - Deploy secrets to CI/CD without storing private keys

Installation

npm install -g @nishan30/envoy-cli

Quick Start

1. Get Your API Key

Visit https://envoy-it.netlify.app/dashboard and generate an API key.

2. Initialize Envoy

envoy init --api-key evy_api_YOUR_KEY_HERE

This will:

• Authenticate with the Envoy server
• Generate encryption keys (downloads id_x25519 private key file)
• Save your configuration

⚠️ IMPORTANT: Store your id_x25519 private key file securely! You'll need it to decrypt your secrets.

3. Push Your Secrets

envoy push -f .env

This will:

• Read your .env file
• Encrypt the contents with your public key
• Upload to secure storage
• Generate a RepoKey for CI/CD deployments

4. Pull Your Secrets

On another machine (with your private key):

envoy pull

In CI/CD (with RepoKey):

envoy pull --key evk_YOUR_REPO_KEY_HERE

Commands

envoy init

Initialize Envoy CLI with your API key.

envoy init --api-key evy_api_YOUR_KEY_HERE

Options:

• --api-key - Your API key from the dashboard (required)
• --private-key - Path to existing private key file (optional)
• --api-url - Custom API URL for self-hosting (optional)

envoy push

Push secrets to the server.

envoy push -f .env

Options:

• -f, --file - Path to your environment file (default: .env)

envoy pull

Pull secrets from the server.

# Pull with your identity (requires private key)
envoy pull

# Pull with RepoKey (for CI/CD)
envoy pull --key evk_YOUR_REPO_KEY_HERE

Options:

• --key - RepoKey for anonymous pull (for CI/CD)
• -o, --output - Output file path (default: .env)

envoy configure

Configure Envoy settings.

# View current configuration
envoy configure --show

# Set API URL (for self-hosting)
envoy configure --api-url https://your-api.com

Workflow Example

Developer Workflow

# One-time setup
npm install -g @nishan30/envoy-cli
envoy init --api-key evy_api_xxx

# Push secrets from your local .env
envoy push -f .env

# On another machine
envoy pull  # Downloads your .env file

CI/CD Workflow

# In your CI/CD pipeline (GitHub Actions, GitLab CI, etc.)
- name: Install Envoy
  run: npm install -g @nishan30/envoy-cli

- name: Pull Secrets
  run: envoy pull --key ${{ secrets.ENVOY_REPO_KEY }}
  
# Now your .env file is available!

Team Collaboration

Invite team members from the web dashboard:

1. Go to your repository page
2. Click "Invite Member"
3. Enter their email
4. Upload your private key to re-wrap the secret for them
5. They can now envoy pull with their own credentials

Security

• Client-Side Encryption: All encryption happens on your machine
• X25519 + XChaCha20-Poly1305: Industry-standard algorithms
• Zero-Knowledge: Server never sees your plaintext secrets
• Key Wrapping: Secrets are wrapped per-user for team access

Support

• Website: https://envoy-it.netlify.app
• GitHub: https://github.com/Nishan30/envoy
• Issues: https://github.com/Nishan30/envoy/issues

License

MIT