envfill

Keep your .env in sync with .env.template

Added a new env var to the template? envfill prompts your team for missing values, validates input, and generates secrets, so nobody runs the app with missing config.

``bash
npx envfill
`

- Syncs — only prompts for new/missing variables, keeps existing values
- Validates — URLs, emails, ports, custom regex
- Generates — secrets, passwords, tokens
- Integrates — shell commands for Vault, 1Password, AWS Secrets Manager

Quick Start

Create .env.template:

`bash


Database password

DB_PASSWORD=

Your user ID

USER_ID=id -u

App environment

NODE_ENV=

Public URL

PUBLIC_URL=

API key (32 alphanumeric chars)

API_KEY=
`

Run npx envfill and get prompted for each value.

Template Syntax

| Value | Behavior |
| --------------------------------- | --------------------------------- |
| PORT=3000 | Default value |
| KEY= | Prompt (no default) |
| UID=id -u | Shell command as default |
| SECRET= | Auto-generate (alphanumeric) |
| TOKEN= | Auto-generate with charset |
| ENV=c> | Options ( = default) |
| URL= | Must provide |
| URL= | URL validation |
| EMAIL= | Email validation |
| PORT= | Port validation |
| COUNT= | Integer in range (min:max) |
| DEBUG= | Yes/no toggle |
| KEY= | Only prompt if VAR is truthy |
| B=${A}_suffix | Variable interpolation |
| KEY= | Custom regex validation |
| KEY= | Regex with flags and custom error |
| NAME= | Transform to lowercase |
| NAME= | Transform to uppercase |
| SLUG= | Slugify (lowercase + dashes) |
| NAME= | Trim chars from edges |
| NAME= | Regex replace |

Combine with comma: or

$3

Control which characters are used in generated secrets:

| Preset | Characters |
| --------- | --------------------- |
| alnum | a-zA-Z0-9 (default) |
| alpha | a-zA-Z |
| lower | a-z |
| upper | A-Z |
| num | 0-9 |
| hex | 0-9a-f |
| HEX | 0-9A-F |
| special | !@#$%^&*()-_=+ |

$3

Transforms modify user input before storing. They apply left-to-right:

`bash


Slugify: "My Cool App" → "my-cool-app"

PROJECT_SLUG=

Chain transforms: " My App! " → "my-app"

NAME=

Replace with regex: "hello world" → "hello_world"

SNAKE_CASE=

Combine with validation

PROJECT_ID=
`

| Transform | Effect | Example |
| --------------------------- | ----------------------------------------------------- | --------------------------------- |
| | Convert to lowercase | "Hello" → "hello" |
| | Convert to uppercase | "Hello" → "HELLO" |
| | Lowercase + replace non-alnum with dash + trim dashes | "My App" → "my-app" |
| | Remove chars from start/end | on "-hello-" → "hello" |
| | Regex replace (g=global, i=case-insensitive) | See above |

Fetching Secrets

Use shell commands to fetch secrets from any secret manager:

`bash


HashiCorp Vault


DB_PASSWORD=vault kv get -field=db_password secret/data/myapp

1Password CLI

API_KEY=op read "op://Vault/API Key/password"

AWS Secrets Manager

SECRET=aws secretsmanager get-secret-value --secret-id myapp --query SecretString --output text
`

CLI Options

`bash
envfill -i config.template -o .env.local
envfill --defaults # Use all defaults
envfill --overwrite # Re-prompt all (ignore existing)
envfill --dry-run # Preview output
`

Multi-Template Support

Layer templates with multiple -i flags (later overrides earlier):

`bash
envfill -i base.template -i prod.template -i secrets.template
`

Variables are replaced in-place; new ones appear under file section headers.

Use in package.json

`json
{
"scripts": {
"setup": "envfill",
"setup:ci": "envfill --defaults"
}
}
`

Then run npm run setup to interactively fill your .env`.

License

MIT