dotenv-vault is a cli to sync .env files across machines, environments, and team members.

![NPM Version](https://npmjs.org/package/dotenv-vault)

> [!NOTE]
> dotenv-vault is a paid only cloud service for syncing your .env files (as of May 2025).
>
> Looking for a free cloud-less alternative? See my new product dotenvx – that lets you:
> - encrypt your .env files
> - commit them to code
> - and securely sync them over git

🌱 Install

It works with a single command. Run npx dotenv-vault@latest push.

``sh npx dotenv-vault@latest push``remote: Securely pushing (.env)... done remote: Securely pushed development (.env) remote: Securely built vault (.env.vault)`

That's it. You securely synced your .env file. Next, tell your teammate to run npx dotenv-vault@latest pull

`sh npx dotenv-vault@latest pull`

Nice!

See further usage and commands.

`🏗️ Usage`

When you make a change to your .env file, push it up.

`bash $ npx dotenv-vault@latest push`

Commit your .env.vault file safely to code.

`bash $ git add .env.vault $ git commit -am "Add .env.vault" $ git push`

Now your teammate can pull the latest .env changes.

`bash $ git pull $ npx dotenv-vault@latest pull`

That's it!

Learn more about usage

`🚀 Deploying`

Stop scattering your production secrets across multiple third-parties and tools. Instead, use an encrypted .env.vault file.

Generate your encrypted .env.vault file.

`bash $ npx dotenv-vault@latest build`

Fetch your production DOTENV_KEY.

`bash $ npx dotenv-vault@latest keys production remote: Listing .env.vault decryption keys... done dotenv://:key_1234…@dotenv.org/vault/.env.vault?environment=production`

Set DOTENV_KEY on your server.

`bash

`heroku example`


heroku config:set DOTENV_KEY=dotenv://:key_1234…@dotenv.org/vault/.env.vault?environment=production

Commit your .env.vault file safely to code and deploy.

`bash $ git add .env.vault $ git commit -am "Update .env.vault" $ git push $ git push heroku main # heroku example`

That's it! On deploy, your .env.vault file will be decrypted and its secrets injected as environment variables – just in time.

Learn more about deploying

`🌴 Manage Multiple Environments`

After you've pushed your .env file, dotenv-vault automatically sets up multiple environments. Manage multiple environments with the included UI. learn more

`$ npx dotenv-vault@latest open production`

That's it! Manage your ci, staging, and production secrets from there.

Would you also like to pull your production .env to your machine? Run the command:

`$ npx dotenv-vault@latest pull production`

Learn more about environments

`📚 Examples`

Vercel	Heroku	GitHub Actions	GitLab CI/CD
Netlify	Docker	Docker Compose	CircleCI
Serverless	Railway	Render	Travis CI
Google Cloud	Fly.io	Slack	Buddy
Cloud66	Digital Ocean	Dagger	Bitbucket
Node.js	Express	NextJS
Remix	Astro	Rails	Ruby
Sinatra	Flask	Python	Supabase
Pulumi	Angular	Nuxt	Vite

See more integration guides

`📖 Commands`

`$ npx dotenv-vault@latest help`

* new * login * logout * push * pull * open * whoami * build * keys * rotatekey * decrypt * versions

`$3`

Create your project at Dotenv Vault.

Example:

`bash $ npx dotenv-vault@latest new`

##### ARGUMENTS

[DOTENV_VAULT]

Set .env.vault identifier. Defaults to generated value.

`$ npx dotenv-vault@latest new vlt_6beaae5… local: Adding .env.vault (DOTENV_VAULT)... done local: Added to .env.vault (DOTENV_VAULT=vlt_6beaa...)`

##### FLAGS

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

---

`$3`

Log in to dotenv-vault.

Example:

`bash $ npx dotenv-vault@latest login`

##### ARGUMENTS

[DOTENV_ME]

Set .env.me identifier. Defaults to generated value.

`$ npx dotenv-vault@latest login me_00c7fa…`

##### FLAGS

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest login -y`

---

`$3`

Log out of dotenv-vault.

Example:

`bash $ npx dotenv-vault@latest logout`

##### FLAGS

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest logout -y`

---

`$3`

Push .env securely.

Example:

`bash $ npx dotenv-vault@latest push`

##### ARGUMENTS

[ENVIRONMENT]

Set environment to push to. Defaults to development

`$ npx dotenv-vault@latest push production`

[FILENAME]

Set input filename. Defaults to .env for development and .env.{environment} for other environments

`$ npx dotenv-vault@latest push production .env.production`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest push --dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest push -y`

---

`$3`

Pull .env securely.

Example:

`bash $ npx dotenv-vault@latest pull`

##### ARGUMENTS

[ENVIRONMENT]

Set environment to pull from. Defaults to development

`$ npx dotenv-vault@latest pull production`

[FILENAME]

Set output filename. Defaults to .env for development and .env.{environment} for other environments

`$ npx dotenv-vault@latest pull production .env.production`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest pull --dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest pull -y`

If you want to pull a specific version you can do so. For example,

`npx dotenv-vault@latest pull development@v14`

---

`$3`

Open project page.

Example:

`bash $ npx dotenv-vault@latest open`

##### ARGUMENTS

[ENVIRONMENT]

Set environment to open to. Defaults to development.

`$ npx dotenv-vault@latest open production`

##### FLAGS

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest open -y`

---

`$3`

Display the current logged in user.

Example:

`bash $ npx dotenv-vault@latest whoami`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest whoami dotenvMe=me_b1831e…`

---

`$3`

Build .env.vault file.

Example:

`bash $ npx dotenv-vault@latest build`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest build dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest build -y`

---

`$3`

List .env.vault decryption keys.

Example:

`bash $ npx dotenv-vault@latest keys`

##### ARGUMENTS

[ENVIRONMENT]

Set environment. Defaults to all.

`$ npx dotenv-vault@latest keys production… remote: Listing .env.vault decryption keys... done dotenv://:key_899..@dotenv.org/vault/.env.vault?environment=production`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest keys dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest keys -y`

---

`$3`

Rotate DOTENV_KEY.

Example:

`bash $ npx dotenv-vault@latest rotatekey production`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest rotatekey dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest rotatekey -y`

---

`$3`

Decrypt .env.vault locally.

Example:

`bash $ npx dotenv-vault@latest decrypt dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=development`

##### ARGUMENTS

[DOTENV_KEY]

Set DOTENV_KEY to decrypt .env.vault. Development key will decrypt development, production will decrypt production, and so on.

`$ npx dotenv-vault@latest decrypt dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=development`

---

`$3`

List version history.

Example:

`bash $ npx dotenv-vault@latest versions`

##### ARGUMENTS

[ENVIRONMENT]

Set environment to check versions against. Defaults to development.

`$ npx dotenv-vault@latest versions production`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest versions dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest versions -y`

If you want to pull a specific version you can do so. For example,

`npx dotenv-vault@latest pull development@v14`

`❓ FAQ`

`$3`

First, make sure you are using dotenv@16.1.0 or greater. (If you are using a different language make sure you have installed one of its libraries.)

Second, test decryption is working locally.

`bash $ npx dotenv-vault@latest decrypt dotenv://:key_1234..@dotenv.local/vault/.env.vault?environment=production

`outputs environment variables`


Third, test decryption on boot is working locally.

`bash $ DOTENV_KEY='dotenv://:key_1234..@dotenv.local/vault/.env.vault?environment=production' npm start

`boots your app with production envs`

$3

Yes. It is safe and recommended to do so. DO commit your .env.vault file to code. DO NOT commit your .env file. The .env.vault file contains ciphertext generated using AES-256. AES-256 is trusted by the US Government to transmit top-secret information and has a brute-force timescale of about a billion years.

`$3`

Does that attacker also have access to your .env.vault file?

* No: good, the attacker cannot do any damage. They need both the DOTENV_KEY and .env.vault file to access your secrets. This extra layer of security sets the .env.vaultfile apart as a superior solution to other SecretOps solutions. * Yes: IMMEDIATELY start rotating your secrets at your third-party API providers. This scenario would be the same no matter what SecretOps solution you use.

After completing the above, rotate your DOTENV_KEY using the rotatekey command, rebuild your .env.vault file, and redeploy.

`$3`

It safer than scattering your secrets across multiple cloud providers. Those providers are focused on code deployment and server performance over secrets security.[1]

Dotenv Vault's singular focus is secrets security, and as a result we go to great lengths to make sure your secrets are safe. Afterall, we keep our secrets here too.[2]

* [[1] CircleCI Breach](https://techcrunch.com/2023/01/05/circleci-breach/) * [[2] Security at Dotenv Vault](https://www.dotenv.org/security)

`$3`

The .env.vault file and its encryption algorithm is language-agnostic so technically it works with any language. We've built convenience libraries for it in a handful of languages and are adding more quickly.

* Go * Kotlin * NodeJS * PHP * Python * Ruby

`$3`

With dotenvx you put your development, staging, ci, and production secrets IN your code - as encrypted .env.* files. So for example, to do production you would

1. Create .env.production with HELLO=production (or in dotenv-vault's case npx dotenv-vault@latest pull production) 2. Rundotenvx encrypt -f .env.productionto encrypt it 3. Commit that to code

Then when deploying your codebase you put dotenvx run -- out front of your run command.

1. Add dotenvx run -- yourstartcommand2. SetDOTENV_PRIVATE_KEY_PRODUCTIONon the server 3. On bootdotenvx run` will read the private key and use it to decrypt and inject your secrets just in time as environment variables

Here's a quickstart guide

Contributing

See CONTRIBUTING.md

Changelog

See CHANGELOG.md

License

MIT

dotenv-vault is a cli to sync .env files across machines, environments, and team members.

![NPM Version](https://npmjs.org/package/dotenv-vault)

🌱 Install

It works with a single command. Run npx dotenv-vault@latest push.

``sh npx dotenv-vault@latest push``remote: Securely pushing (.env)... done remote: Securely pushed development (.env) remote: Securely built vault (.env.vault)`

That's it. You securely synced your .env file. Next, tell your teammate to run npx dotenv-vault@latest pull

`sh npx dotenv-vault@latest pull`

Nice!

See further usage and commands.

`🏗️ Usage`

When you make a change to your .env file, push it up.

`bash $ npx dotenv-vault@latest push`

Commit your .env.vault file safely to code.

`bash $ git add .env.vault $ git commit -am "Add .env.vault" $ git push`

Now your teammate can pull the latest .env changes.

`bash $ git pull $ npx dotenv-vault@latest pull`

That's it!

Learn more about usage

`🚀 Deploying`

Stop scattering your production secrets across multiple third-parties and tools. Instead, use an encrypted .env.vault file.

Generate your encrypted .env.vault file.

`bash $ npx dotenv-vault@latest build`

Fetch your production DOTENV_KEY.

`bash $ npx dotenv-vault@latest keys production remote: Listing .env.vault decryption keys... done dotenv://:key_1234…@dotenv.org/vault/.env.vault?environment=production`

Set DOTENV_KEY on your server.

`bash

`heroku example`


heroku config:set DOTENV_KEY=dotenv://:key_1234…@dotenv.org/vault/.env.vault?environment=production

Commit your .env.vault file safely to code and deploy.

`bash $ git add .env.vault $ git commit -am "Update .env.vault" $ git push $ git push heroku main # heroku example`

That's it! On deploy, your .env.vault file will be decrypted and its secrets injected as environment variables – just in time.

Learn more about deploying

`🌴 Manage Multiple Environments`

After you've pushed your .env file, dotenv-vault automatically sets up multiple environments. Manage multiple environments with the included UI. learn more

`$ npx dotenv-vault@latest open production`

That's it! Manage your ci, staging, and production secrets from there.

Would you also like to pull your production .env to your machine? Run the command:

`$ npx dotenv-vault@latest pull production`

Learn more about environments

`📚 Examples`

Vercel	Heroku	GitHub Actions	GitLab CI/CD
Netlify	Docker	Docker Compose	CircleCI
Serverless	Railway	Render	Travis CI
Google Cloud	Fly.io	Slack	Buddy
Cloud66	Digital Ocean	Dagger	Bitbucket
Node.js	Express	NextJS
Remix	Astro	Rails	Ruby
Sinatra	Flask	Python	Supabase
Pulumi	Angular	Nuxt	Vite

See more integration guides

`📖 Commands`

`$ npx dotenv-vault@latest help`

* new * login * logout * push * pull * open * whoami * build * keys * rotatekey * decrypt * versions

`$3`

Create your project at Dotenv Vault.

Example:

`bash $ npx dotenv-vault@latest new`

##### ARGUMENTS

[DOTENV_VAULT]

Set .env.vault identifier. Defaults to generated value.

`$ npx dotenv-vault@latest new vlt_6beaae5… local: Adding .env.vault (DOTENV_VAULT)... done local: Added to .env.vault (DOTENV_VAULT=vlt_6beaa...)`

##### FLAGS

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

---

`$3`

Log in to dotenv-vault.

Example:

`bash $ npx dotenv-vault@latest login`

##### ARGUMENTS

[DOTENV_ME]

Set .env.me identifier. Defaults to generated value.

`$ npx dotenv-vault@latest login me_00c7fa…`

##### FLAGS

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest login -y`

---

`$3`

Log out of dotenv-vault.

Example:

`bash $ npx dotenv-vault@latest logout`

##### FLAGS

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest logout -y`

---

`$3`

Push .env securely.

Example:

`bash $ npx dotenv-vault@latest push`

##### ARGUMENTS

[ENVIRONMENT]

Set environment to push to. Defaults to development

`$ npx dotenv-vault@latest push production`

[FILENAME]

Set input filename. Defaults to .env for development and .env.{environment} for other environments

`$ npx dotenv-vault@latest push production .env.production`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest push --dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest push -y`

---

`$3`

Pull .env securely.

Example:

`bash $ npx dotenv-vault@latest pull`

##### ARGUMENTS

[ENVIRONMENT]

Set environment to pull from. Defaults to development

`$ npx dotenv-vault@latest pull production`

[FILENAME]

Set output filename. Defaults to .env for development and .env.{environment} for other environments

`$ npx dotenv-vault@latest pull production .env.production`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest pull --dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest pull -y`

If you want to pull a specific version you can do so. For example,

`npx dotenv-vault@latest pull development@v14`

---

`$3`

Open project page.

Example:

`bash $ npx dotenv-vault@latest open`

##### ARGUMENTS

[ENVIRONMENT]

Set environment to open to. Defaults to development.

`$ npx dotenv-vault@latest open production`

##### FLAGS

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest open -y`

---

`$3`

Display the current logged in user.

Example:

`bash $ npx dotenv-vault@latest whoami`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest whoami dotenvMe=me_b1831e…`

---

`$3`

Build .env.vault file.

Example:

`bash $ npx dotenv-vault@latest build`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest build dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest build -y`

---

`$3`

List .env.vault decryption keys.

Example:

`bash $ npx dotenv-vault@latest keys`

##### ARGUMENTS

[ENVIRONMENT]

Set environment. Defaults to all.

`$ npx dotenv-vault@latest keys production… remote: Listing .env.vault decryption keys... done dotenv://:key_899..@dotenv.org/vault/.env.vault?environment=production`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest keys dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest keys -y`

---

`$3`

Rotate DOTENV_KEY.

Example:

`bash $ npx dotenv-vault@latest rotatekey production`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest rotatekey dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest rotatekey -y`

---

`$3`

Decrypt .env.vault locally.

Example:

`bash $ npx dotenv-vault@latest decrypt dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=development`

##### ARGUMENTS

[DOTENV_KEY]

Set DOTENV_KEY to decrypt .env.vault. Development key will decrypt development, production will decrypt production, and so on.

`$ npx dotenv-vault@latest decrypt dotenv://:key_1234@dotenv.org/vault/.env.vault?environment=development`

---

`$3`

List version history.

Example:

`bash $ npx dotenv-vault@latest versions`

##### ARGUMENTS

[ENVIRONMENT]

Set environment to check versions against. Defaults to development.

`$ npx dotenv-vault@latest versions production`

##### FLAGS

-m, --dotenvMe

Pass .env.me (DOTENV_ME) credential directly (rather than reading from .env.me file)

`$ npx dotenv-vault@latest versions dotenvMe=me_b1831e…`

-y, --yes

Automatic yes to prompts. Assume yes to all prompts and run non-interactively.

`$ npx dotenv-vault@latest versions -y`

If you want to pull a specific version you can do so. For example,

`npx dotenv-vault@latest pull development@v14`

`❓ FAQ`

`$3`

First, make sure you are using dotenv@16.1.0 or greater. (If you are using a different language make sure you have installed one of its libraries.)

Second, test decryption is working locally.

`bash $ npx dotenv-vault@latest decrypt dotenv://:key_1234..@dotenv.local/vault/.env.vault?environment=production

`outputs environment variables`


Third, test decryption on boot is working locally.

`bash $ DOTENV_KEY='dotenv://:key_1234..@dotenv.local/vault/.env.vault?environment=production' npm start

`boots your app with production envs`

$3

`$3`

Does that attacker also have access to your .env.vault file?

After completing the above, rotate your DOTENV_KEY using the rotatekey command, rebuild your .env.vault file, and redeploy.

`$3`

It safer than scattering your secrets across multiple cloud providers. Those providers are focused on code deployment and server performance over secrets security.[1]

Dotenv Vault's singular focus is secrets security, and as a result we go to great lengths to make sure your secrets are safe. Afterall, we keep our secrets here too.[2]

* [[1] CircleCI Breach](https://techcrunch.com/2023/01/05/circleci-breach/) * [[2] Security at Dotenv Vault](https://www.dotenv.org/security)

`$3`

* Go * Kotlin * NodeJS * PHP * Python * Ruby

`$3`

With dotenvx you put your development, staging, ci, and production secrets IN your code - as encrypted .env.* files. So for example, to do production you would

Then when deploying your codebase you put dotenvx run -- out front of your run command.

Here's a quickstart guide

Contributing

See CONTRIBUTING.md

Changelog

See CHANGELOG.md

License

MIT