@secr/cli

Stop committing .env files. Start managing secrets properly.

secr is a CLI-first secrets manager for development teams. Encrypt, sync, and inject environment variables across your team — without writing them to disk.

Website · Docs · Dashboard · Blog

Why secr?

• No more .env files in Slack — secrets are encrypted and synced automatically
• Zero-disk injection — secr run injects secrets into your process without writing to disk
• Onboard in 30 seconds — new developer? npm i -g @secr/cli && secr login && secr run
• Leak prevention built in — scan your codebase for credentials and block commits with leaked secrets
• Enterprise SSO — SAML, OIDC, SCIM directory sync, MFA, and passkeys via WorkOS
• Free for small teams — 3 projects, unlimited users, no credit card

Install

# Homebrew (macOS / Linux)
brew tap secr-dev/secr
brew install secr

# npm / pnpm / yarn
npm install -g @secr/cli

Quick start

# 1. Authenticate (opens browser — supports SSO)
secr login

# 2. Create a project
secr init

# 3. Add secrets
secr set DATABASE_URL=postgres://localhost/mydb
secr set STRIPE_KEY=sk_live_...

# 4. Run your app with secrets injected (nothing on disk)
secr run "npm start"

That's it. Every team member gets the same secrets, always in sync.

What you can do

Manage secrets

secr set KEY=value                  # Set a secret
secr set --from-env .env            # Bulk import from .env file
secr pull                           # Pull all secrets
secr pull --format dotenv > .env    # Export as .env
secr ls                             # List secret keys
secr delete KEY1 KEY2               # Delete secrets
secr diff staging production        # Compare environments
secr promote staging production     # Copy secrets between environments

Prevent leaks

secr scan                           # Scan codebase for 20+ credential patterns
secr scan --pre-commit              # Check staged files only
secr guard install                  # Install git pre-commit hook
secr guard status                   # Check hook status

Import from anywhere

secr migrate .env                   # Import from .env files
secr import --from vercel           # Import from Vercel
secr import --from heroku           # Import from Heroku
secr import --from aws-sm           # Import from AWS Secrets Manager
secr import --from render           # Import from Render
secr import --from railway          # Import from Railway
secr import --from netlify          # Import from Netlify
secr import --from github           # Import from GitHub Actions
secr import --from cloudflare       # Import from Cloudflare Pages
secr import --from fly              # Import from Fly.io
secr import --from digitalocean     # Import from DigitalOcean
secr import --from supabase         # Import from Supabase
secr import --from aws-ps           # Import from AWS Parameter Store

Share secrets securely

secr share "sk_live_abc123"              # One-time encrypted link
secr share "token" --expires 24h         # Expires in 24 hours
secr share "key" --views 5 --label "DB"  # 5 views max, labeled
secr share --list                        # View active share links
secr share --revoke <id>                 # Revoke a link

Team and org management

secr org create "Acme Corp"         # Create an organization
secr env list                       # List environments
secr env create custom-env          # Create a custom environment
secr template list                  # View required key templates
secr template validate              # Check secrets match template
secr log                            # View audit trail

Integrations

secr postman connect                # Sync secrets to Postman
secr postman sync                   # Push latest secrets to Postman
secr config export --output bak.json  # Export project config
secr config import config.json      # Import project config
secr completion bash                # Shell completions (bash/zsh/fish)

Authentication

secr supports two authentication modes:

• SSO (SAML/OIDC) — secr login opens your identity provider in the browser. Supports Okta, Azure AD, Google Workspace, and any SAML 2.0 / OIDC provider via WorkOS.
• Email/password — browser-based login with callback to the CLI.
• CI/CD tokens — secr login --token <token> for non-interactive environments.

Platform integrations

secr works with your existing stack:

| Platform | Package | |----------|---------| | Vercel | @secr/vercel | | Netlify | @secr/netlify-plugin | | GitHub Actions | secr-dev/secr-action | | Terraform | secr provider | | Postman | Built-in (secr postman connect) |

SDKs: TypeScript · Python · Go

Security

• AES-256-GCM envelope encryption with per-project keys wrapped by AWS, GCP, or Azure KMS
• Zero disk — secr run injects via environment variables, nothing written to .env
• RBAC — owner, admin, developer, viewer roles with environment-level permissions
• Audit trail — every access, change, and rotation is logged
• Secret scanning — 20+ patterns including AWS keys, GitHub tokens, Stripe keys, JWTs
• SSO/SCIM — enterprise identity management via WorkOS
• MFA & passkeys — WebAuthn-based authentication

All commands

| Command | Description | |---------|-------------| | secr login | Authenticate (SSO or browser) | | secr init | Create a new project | | secr link | Link to an existing project | | secr set | Set one or more secrets | | secr pull | Pull decrypted secrets | | secr run | Run a command with secrets injected | | secr ls | List secret keys | | secr delete | Delete one or more secrets | | secr diff | Compare environments | | secr promote | Copy secrets between environments | | secr template | Manage required key templates | | secr scan | Scan for leaked credentials | | secr guard | Install/manage pre-commit hook | | secr env | Manage environments | | secr rotate-key | Rotate project encryption key | | secr log | View audit log | | secr share | Create encrypted share links | | secr migrate | Import from .env files | | secr import | Import from 12+ cloud providers | | secr postman | Postman sync integration | | secr org | Manage organizations | | secr config | Export/import project config | | secr completion | Shell completions (bash/zsh/fish) |

Comparison

| Feature | secr | dotenv | Doppler | Vault | |---------|------|--------|---------|-------| | Encrypted at rest | AES-256-GCM | No | Yes | Yes | | Zero-disk injection | Yes | No | Yes | No | | Secret scanning | 20+ patterns | No | No | No | | Pre-commit hook | Yes | No | No | No | | Provider import | 12+ providers | No | Limited | No | | Free tier | 3 projects, unlimited users | N/A | 5 users | OSS only | | SSO/SCIM | Yes (WorkOS) | No | Enterprise | Enterprise |

Documentation

Full documentation at secr.dev/docs.

• Getting started
• CLI reference
• API reference
• Security architecture
• Self-hosting

License

MIT