teamsecret

Pull your team's encrypted secrets into .env — one command, zero copy-paste.

TeamSecret is an open-source encrypted vault for environment variables. This CLI tool syncs secrets from your TeamSecret server directly into your project's .env file.

Install

npm install -g teamsecret
# or use directly
npx teamsecret development

Setup

1. Save your API key

Get an API key from your project's settings page in TeamSecret, then:

echo "te_your_api_key_here" > ~/.teamsecret

Or set the TEAMSECRET_API_KEY environment variable.

2. Add config to your project

Create a .teamsecret.json at the root of your project:

{
  "url": "https://your-teamsecret-instance.com",
  "projectId": "your-project-id",
  "environment": "development"
}

3. Pull secrets

npx teamsecret development
npx teamsecret staging
npx teamsecret production

This writes a .env file with your decrypted secrets.

Auto-sync on install

Add to your project's package.json:

{
  "scripts": {
    "postinstall": "npx teamsecret development"
  }
}

Now every git clone + npm install automatically sets up the environment.

CI/CD

Use the TEAMSECRET_API_KEY environment variable in your CI pipeline:

# GitHub Actions
- name: Pull secrets
  run: npx teamsecret production
  env:
    TEAMSECRET_API_KEY: ${{ secrets.TEAMSECRET_API_KEY }}

Security

• Secrets are encrypted with AES-256-GCM on the server
• API keys are hashed (SHA-256) — the server never stores your key in plain text
• Decryption happens server-side; the CLI receives already-decrypted values over HTTPS
• The encryption master key never touches the database

Self-hosting

TeamSecret is fully open-source and self-hostable. See the main repository for setup instructions.

License

MIT