envspot

Encrypted environment variables for your team, managed from the command line.

envspot is the command-line client for envSpot. Link a directory to a project, pull your secrets straight into a process, and keep .env files off disk and out of git.

This package is the CLI. envSpot is also a hosted platform — a web dashboard for projects, environments, team access, audit history, and syncing secrets to your deploy targets — at envspot.com.

Install

npm install -g envspot

Or run it without installing:

npx envspot <command>

Requires Node.js 18 or newer.

Quick start

envspot init                # create + link a project, import your .env, start your dev server
envspot login               # sign in via browser device pairing
envspot link                # link this directory to a project + environment
envspot run -- npm start    # run a command with your secrets injected as env vars

Commands

| Command | What it does | | ----------------- | --------------------------------------------------------------------------------------- | | init | Create a project from this directory, link it, import .env, and start your dev server | | login | Sign in via browser device pairing, or store an API key for token login | | logout | Remove the stored credential | | link | Write ./.envspot.json (project id + environment); asks first if already linked | | run -- <cmd> | Run a command with the linked project's secrets injected as environment variables | | dump | Print the linked project's secrets as KEY=value to stdout (asks first) | | set <key> <val> | Set one secret for the linked project (asks first) | | unset <key> | Delete one secret and its version history (asks first) | | status | Show the API/app URL and your credential + link state | | whoami | Show the signed-in user, workspace, and active link or token scope | | fly deploy | Stage the linked project's secrets to Fly.io and deploy |

Run envspot help or envspot <command> --help for full options.

Integrations

envSpot syncs your secrets to your deployment targets so you set a value once and it lands everywhere. Supported targets: GitHub Actions, Vercel, Render, Railway, and Fly.io — connected and managed in the dashboard.

fly deploy is the one target you can push to directly from the CLI; the rest sync automatically once connected in the dashboard.

Configuration

| Variable | Purpose | | --------------- | ------------------------------------------------------------ | | ENVSPOT_TOKEN | API key for non-interactive / CI use (skips the OS keychain) |

How your secrets are handled

• Decryption happens server-side. No master key or data-encryption key ever lives on your machine.
• Plaintext secrets stay in memory. run holds them only for the lifetime of the child process; nothing is written to disk as a secret bundle.
• Your credential lives in the OS keychain, not a plaintext file. On an expired or revoked token, the CLI clears it and asks you to sign in again.
• .envspot.json is safe to commit — it holds only the project id and environment label, never secrets.

Links

• Website: https://envspot.com
• Docs: https://envspot.com/docs
• Questions or bug reports: [email protected]

License

MIT