Compare
Envlet and dotenv-vault
dotenv-vault encrypts your .env into a file you commit and decrypts it at runtime with a key per environment. Envlet keeps values on a server and resolves them per identity at boot.
What dotenv-vault does well
dotenv-vault keeps the file-based model: an encrypted .env.vault in the repository and a DOTENV_KEY per environment. It is simple and it needs no account in production. It has no per-identity policy and no audit log of reads.
Where Envlet differs
- Who counts as a seat
- Envlet bills humans only. Five coding agents are five identities and zero seats, on every plan including Free.
- Agents are first-class identities
- Every coding agent gets its own identity and token. Production starts withheld for it, and the audit log shows what it read, by name.
- Setup is one command, or one sentence
- envlet run -- in front of the command you already use, or the MCP server and the words move us to Envlet. Nothing to install on the host, nothing to operate.
- Who gets what
- In Envlet a variable can be shared, different for one identity, or withheld from it, and every read is logged. A committed vault file gives everyone with the key the same set of values.
Pick Envlet when
You have more than one reader, agents among them, and you want to know who read what.
Pick dotenv-vault when
You want the values to live in the repository and every reader to see the same thing.