Compare
Envlet and dotenv-vault
dotenv-vault encrypts your .env into a file you commit and decrypts it at runtime with a key per environment. Envlet keeps values on a server and resolves them per token at boot.
What dotenv-vault does well
dotenv-vault keeps the file-based model: an encrypted .env.vault in the repository and a DOTENV_KEY per environment. It is simple and it needs no account in production. It has no per-reader policy and no audit log of reads.
Where Envlet differs
- 01Who counts as a seat
- Envlet bills humans only. Five coding agents are five tokens and zero seats, on every plan including Free.
- 02Agents get their own tokens
- Every coding agent gets its own token. Production starts withheld for it, and the audit log shows what it read, under its own name.
- 03Setup is one command, or one sentence
- envlet run -- in front of the command you already use, or the MCP server and the words move us to Envlet. Nothing to install on the host, nothing to operate.
- 04Who gets what
- In Envlet a variable can be shared, different for one person or agent, or withheld from it, and every read is logged. A committed vault file gives everyone with the key the same set of values.
When to pick which
Pick Envlet when
You have more than one reader, agents among them, and you want to know who read what.
Pick dotenv-vault when
You want the values to live in the repository and every reader to see the same thing.