Interactive CLI to populate .env files from templates
npm install envfillKeep your .env in sync with .env.template
Added a new env var to the template? envfill prompts your team for missing values, validates input, and generates secrets, so nobody runs the app with missing config.
``bash`
npx envfill
- Syncs — only prompts for new/missing variables, keeps existing values
- Validates — URLs, emails, ports, custom regex
- Generates — secrets, passwords, tokens
- Integrates — shell commands for Vault, 1Password, AWS Secrets Manager
Create .env.template:
`bashDatabase password
DB_PASSWORD=
App environment
NODE_ENV=Public URL
PUBLIC_URL=API key (32 alphanumeric chars)
API_KEY=
`Run
npx envfill and get prompted for each value.Template Syntax
| Value | Behavior |
| --------------------------------- | --------------------------------- |
|
PORT=3000 | Default value |
| KEY= | Prompt (no default) |
| UID=id -u | Shell command as default |
| SECRET= | Auto-generate (alphanumeric) |
| TOKEN= | Auto-generate with charset |
| ENV=c> | Options ( = default) |
| URL= | Must provide |
| URL= | URL validation |
| EMAIL= | Email validation |
| PORT= | Port validation |
| COUNT= | Integer in range (min:max) |
| DEBUG= | Yes/no toggle |
| KEY= | Only prompt if VAR is truthy |
| B=${A}_suffix | Variable interpolation |
| KEY= | Custom regex validation |
| KEY= | Regex with flags and custom error |
| NAME= | Transform to lowercase |
| NAME= | Transform to uppercase |
| SLUG= | Slugify (lowercase + dashes) |
| NAME= | Trim chars from edges |
| NAME= | Regex replace |Combine with comma:
or $3
Control which characters are used in generated secrets:
| Preset | Characters |
| --------- | --------------------- |
|
alnum | a-zA-Z0-9 (default) |
| alpha | a-zA-Z |
| lower | a-z |
| upper | A-Z |
| num | 0-9 |
| hex | 0-9a-f |
| HEX | 0-9A-F |
| special | !@#$%^&*()-_=+ |$3
Transforms modify user input before storing. They apply left-to-right:
`bash
Slugify: "My Cool App" → "my-cool-app"
PROJECT_SLUG=Chain transforms: " My App! " → "my-app"
NAME=Replace with regex: "hello world" → "hello_world"
SNAKE_CASE=Combine with validation
PROJECT_ID=
`| Transform | Effect | Example |
| --------------------------- | ----------------------------------------------------- | --------------------------------- |
|
| Convert to lowercase | "Hello" → "hello" |
| | Convert to uppercase | "Hello" → "HELLO" |
| | Lowercase + replace non-alnum with dash + trim dashes | "My App" → "my-app" |
| | Remove chars from start/end | on "-hello-" → "hello" |
| | Regex replace (g=global, i=case-insensitive) | See above |Fetching Secrets
Use shell commands to fetch secrets from any secret manager:
`bash
HashiCorp Vault
DB_PASSWORD=vault kv get -field=db_password secret/data/myapp1Password CLI
API_KEY=op read "op://Vault/API Key/password"AWS Secrets Manager
SECRET=aws secretsmanager get-secret-value --secret-id myapp --query SecretString --output text
`CLI Options
`bash
envfill -i config.template -o .env.local
envfill --defaults # Use all defaults
envfill --overwrite # Re-prompt all (ignore existing)
envfill --dry-run # Preview output
`Multi-Template Support
Layer templates with multiple
-i flags (later overrides earlier):`bash
envfill -i base.template -i prod.template -i secrets.template
`Variables are replaced in-place; new ones appear under file section headers.
Use in package.json
`json
{
"scripts": {
"setup": "envfill",
"setup:ci": "envfill --defaults"
}
}
`Then run
npm run setup to interactively fill your .env`.MIT