EnvShare CLI

Share secrets securely from your terminal. Zero-knowledge encryption.

The official CLI for EnvShare.app. Encrypts data locally before sending it to the server — the key never leaves your machine.

Features

• Zero-Knowledge: Secrets are encrypted on your machine using AES-256-GCM. The server never sees the key.
• API Key Auth: Authenticate with your personal API key (env_...) — no Turnstile captcha needed.
• Easy Uploads: Share .env files or text snippets instantly.
• Pipe Support: Echo secrets directly into the CLI.
• Security Scan: Scan files for sensitive data before committing.
• Secure Defaults: 24h expiry, one-time view.

Quick Start

1. Get Your API Key

Generate an API key from your EnvShareApp Settings page (requires Pro or Team plan).

export ENVSHARE_API_KEY="env_your_key_here"

2. Upload a Secret

npx envshareapp upload .env.production

Or install globally:

npm install -g envshareapp
envshareapp upload .env

Usage

Upload a File

envshareapp upload .env.production

Share Text via Pipe

echo "SUPER_SECRET_KEY" | envshareapp upload

Scan & Audit

# Scan a file for secrets before uploading
envshareapp scan .env

# Scan directory recursively
envshareapp scan ./src

Options

# Set specific expiry (in hours: 1, 24, 168)
envshareapp upload .env --expires 1

# Set max views before self-destruct
envshareapp upload .env --views 5

# Password protect (Pro)
envshareapp upload .env --password "my-pass"

Environment Variables

| Variable | Default | Description | |----------|---------|-------------| | ENVSHARE_API_KEY | (required in production) | Your API key (starts with env_). Generate at /settings. | | ENVSHARE_API_URL | https://envshare.app/api/secrets | API endpoint. Set to http://localhost:3000/api/secrets for local dev. | | ENVSHARE_BASE_URL | https://envshare.app | Base URL for generated share links. |

Authentication

The CLI uses API Key authentication. When ENVSHARE_API_KEY is set, it sends the key as a Bearer token in the Authorization header, which bypasses Turnstile verification entirely.

For local development (when API URL points to localhost), no API key is needed — the CLI automatically uses the Turnstile test key.

Security

• Encryption: AES-256-GCM (256-bit key).
• Key Derivation: PBKDF2 — 250,000 iterations (random key) or 100,000 iterations (password-based).
• Transport: SSL/TLS.
• Zero-Knowledge: The decryption key is appended to the URL fragment (#) and never sent to the server.

License

ISC © Xplrosolutions OPC Pvt Ltd