envwallet-cli

Sync environment variables from your EnvWallet account into any project — no tokens to copy, no wallet IDs to memorize.

Package: envwallet-cli · Command: envwallet Run it ad-hoc with npx envwallet-cli …, or install it globally (npm i -g envwallet-cli) and use the shorter envwallet ….

Quick start

# 1. Authorize this machine (opens your browser to approve)
npx envwallet-cli login

# 2. Link the current project to one of your wallets
cd my-app
npx envwallet-cli link        # writes .envwallet.json

# 3. Pull it into .env whenever you need it
npx envwallet-cli pull

After npm i -g envwallet-cli these become envwallet login, envwallet pull, etc.

Commands

| Command | What it does | | --- | --- | | envwallet login | Device-code login. Opens the browser; you approve, the token is saved to ~/.envwallet/config.json (chmod 600). | | envwallet logout | Removes the saved token. | | envwallet whoami | Verifies the current token. | | envwallet list | Lists your wallets as id project [environment]. | | envwallet link | Interactively pick a wallet for this project → .envwallet.json. | | envwallet pull | Writes the linked wallet to .env. | | envwallet run -- <cmd> | Runs <cmd> with the wallet's variables injected — nothing written to disk. |

pull options

envwallet pull --id <walletId>   # ignore the link file, use a specific wallet
envwallet pull -o config/.env    # custom output path
envwallet pull -o -              # write to stdout
envwallet pull --no-secrets      # omit sensitive values

Run a process with injected vars

envwallet run -- npm run dev
envwallet run --id <walletId> -- ./server

CI / non-interactive use

Set a token directly instead of logging in interactively:

ENVWALLET_TOKEN=ew_xxx envwallet pull --id <walletId> -o .env

Create or revoke tokens from Dashboard → Connected CLIs.

Config

• ~/.envwallet/config.json — global: { apiUrl, token } (chmod 600).
• .envwallet.json — per-project: { walletId, project, environment }. Safe to commit.
• ENVWALLET_API — override the API base URL (self-hosting / testing).
• ENVWALLET_TOKEN — override the token (CI).

Keep .env in .gitignore. Commit .envwallet.json, never your token.

Upgrading from 2.x ⚠️ (breaking)

v3 is a ground-up rewrite targeting the current EnvWallet wallets API. Key changes:

• Auth: API keys (envwallet configure) are replaced by browser-based device login (envwallet login). Your old API key is no longer used.
• .envwallet.json: in 2.x this stored your API key; in 3.x it's a project link ({ walletId, … }). The CLI detects an old file and prompts you to re-link. Re-run login then link.
• Removed commands: configure, push, load, key-export, env-direct, select-project, me, test-db, and other 2.x debug commands. push (upload .env → wallet) is not in 3.0 — open an issue if you need it.
• Env var: the base-URL override is now ENVWALLET_API (was ENVWALLET_API_URL).

Security

• Only a SHA-256 hash of each token is stored server-side; the raw token is shown once.
• Tokens grant read access to your wallets and are revocable at any time from the dashboard.
• Secrets are encrypted at rest and only decrypted in the export response over HTTPS.