Your .env, everywhere.
On your terms.
Store your env vars in one place. Give each teammate, coding agent, and deployment the values you choose.
Free for one person. Unlimited agents and CI.
One place, not seven
The same values live in GitHub, AWS, Vercel, a .env on every laptop, and a settings file in Cursor. Put them in Envlet once. Everything else reads from it.
Migrate with one prompt
Add the Envlet MCP server to Claude Code, Cursor, or Codex and run the migrate prompt. The agent signs you in, creates the project, imports your .env files, and creates its own token with production withheld.
- working
claude mcp add --scope user envlet -- npx -y @envlet/cli mcp
Integrate before lunch
One token in your runtime. SDKs for the languages you already write, a CLI for everything else, and a plain REST API underneath.
import { inject } from "@envlet/sdk";
await inject();
const stripe = new Stripe(process.env.STRIPE_KEY);Decide who gets what
Give a value to everyone, change it for one teammate, or keep it away from an agent. The variable name stays the same for all of them.
| Variable | mayahuman | claudeagent | cici job |
|---|---|---|---|
| DATABASE_URL | ••••••••shared | ••••••••shared | ••••••••shared |
| STRIPE_KEY | ••••••••shared | -withheld | ••••••••override |
| API_URL | ••••••••shared | ••••••••override | ••••••••shared |
| DEPLOY_TOKEN | ••••••••shared | -withheld | ••••••••shared |
| SENTRY_DSN | ••••••••shared | ••••••••shared | ••••••••shared |
Give every agent its own token
Claude, Codex, and Cursor each get a token for one environment. Mark a value withheld and it is left out of that agent's environment.
- DATABASE_URLshared
- API_URLoverride
- REDIS_URLshared
- SENTRY_DSNshared
- STRIPE_KEYwithheld
- DEPLOY_TOKENwithheld
- DATABASE_URLshared
- API_URLshared
- REDIS_URLshared
- SENTRY_DSNwithheld
- STRIPE_KEYwithheld
- DEPLOY_TOKENwithheld
- DATABASE_URLoverride
- API_URLshared
- REDIS_URLshared
- SENTRY_DSNshared
- STRIPE_KEYwithheld
- DEPLOY_TOKENwithheld
Know who read what
Every read records who read, the project, environment, key names, and time. The values themselves are never in the log.
Encrypted one value at a time.
Nine rules cover how a value is stored, who can read it, and what the log keeps. Open any one to see how it works.
Encryption per value
Each value gets its own AES-256-GCM ciphertext.
Two values in the same environment never share a ciphertext, so one exposure stays one value.
One data key per project
Values in a project are encrypted under that project's own data key.
The data key is stored wrapped by a root key. The root key exists only as a Worker secret, never in the database.
Context binding
A ciphertext only decrypts in its own project, environment, and variable name.
Those three names are bound into the encryption as associated data. Moved anywhere else, the ciphertext fails to decrypt.
Key rotation
Rotate the root key without touching a single value.
Rotation rewraps each project's data key. The encrypted values stay where they are.
Scoped tokens that expire
A token opens one project and one environment, then expires.
There is no token without a scope and an expiry. An expired token resolves nothing.
Tokens stored as digests
The raw token is shown once, when you create it.
The database stores only its digest. Nobody, including us, can read a token back.
Withheld values
Mark a value withheld for an agent and it is left out of that agent's environment.
A withheld value is not sent to the client at all. The command runs without it.
Audit records name keys, not values
Every read records who read, the project, environment, key names, source, and time.
Values never enter the audit record, so the log can be kept for as long as you need it.
Encrypted local cache
The CLI keeps the last resolution encrypted on disk for five minutes.
A network blip inside that window does not stop your command. After five minutes the cache expires and the CLI resolves again.
Frequently asked questions
- What is Envlet?
Envlet keeps your project's env vars in one place. Your team, your coding agents, and CI all get the right values by running one command.
- How is Envlet different from Doppler or Infisical?
Envlet is the smaller tool. It keeps shared env vars for people, coding agents, and CI, and for each variable it lets you decide who gets the value, who gets a different one, and who gets none. Install the CLI, sign in, and run your command.
- How do agents and CI authenticate?
Create a token for each agent or CI job in the dashboard. A token works for one project and one environment, and it expires.
- What does Envlet store?
Your values, stored encrypted. Tokens are stored only as digests, so the raw token is shown once when you create it.
- How do I use it in a project?
Install the CLI with npm install -g @envlet/cli, then run envlet login and envlet init inside your project. From then on, start any command with envlet run -- your command.
- What does the free plan include?
Free is everything for one person: unlimited projects, environments, resolves, and agent and CI identities. From the second human member it is $10 per member per month. Agents and CI never count as members.
- Can I keep a value away from an agent?
Yes. Mark any variable as withheld for an agent and it never enters that agent's environment. You can also give an agent its own value for a variable.