CLI documentation

Run any command with the right environment.

Select a project and environment once, then resolve it for a developer, agent, or CI job under its own policy.

Install, sign in, select, and run

Use Node.js 22 or later on macOS or Linux. Run project commands from inside a Git repository.

Install

Install Envlet from npm

Install the package globally to make the envlet command available in your terminal.

Terminal

npm install -g @envlet/cli

Complete the device code flow

Envlet prints a browser URL and device code, then waits for approval. A successful login saves a time-limited credential in ~/.envlet/credentials.json with file mode 0600.

Terminal

envlet login

Init

Bind the repository to one environment

Run this inside a Git repository. Choose a project and environment. Envlet writes their names and stable IDs to .envlet at the repository root. It holds names, not values, so commit it.

Terminal

envlet init [--force]

Run

Inject the resolved environment

The -- separator is required. Envlet resolves the selected project and environment, applies the policy for whoever is signed in or holds the token, and starts the command with those variables.

Terminal

envlet run -- <command> [args]

List

Print the resolved variable names

List the variable names you can read, in sorted order. Add --values to include each resolved value.

Terminal

envlet list [--values]

Pull

Write the resolved values to .env

Write the selected environment to a local .env file. Keep it out of Git.

Terminal

envlet pull [--force]

Set

Set a shared value or a per-reader override

Create or update a shared variable in the selected environment. Add --as <name> to set a different value for one person, agent, or CI job that already has access to that environment.

Terminal

envlet set KEY=value [--as <name>]

CI and agents

Use one token for one project and one environment

Give each CI job or agent the token for the environment it must resolve. Use separate tokens for staging and production.

Mint one environment token

In the dashboard, open Access, choose who the token is for, then the project, environment, and expiry. Envlet shows the raw token once and stores only its digest.

Store it outside the repository

Save the raw token in the secret store for the CI job or agent. Export it as ENVLET_TOKEN when that process starts.

Resolve the matching .envlet

The token can resolve only the project and environment in its scope. That scope must match the stable IDs in the repository's .envlet file.

Start the command without the token

Envlet applies the token's set, override, and withhold policy, audits the resolved key names, and removes the ENVLET_TOKEN credential from the inherited environment before the child process starts.

Export the token before Envlet starts

Keep it in the CI or agent secret store. The child command gets the resolved values, never the token.

Terminal

export ENVLET_TOKEN="paste-the-token-here"
envlet run -- npm test

Run in production

Your platform holds one secret, ENVLET_TOKEN. The app pulls everything else from Envlet at boot.

Node SDK

Install @envlet/sdk and call inject() before your app reads its configuration. Values already set by the host are never overwritten. load() returns the values as an object and also works in edge runtimes.

Terminal

npm install @envlet/sdk

// at the top of your entrypoint
import { inject } from "@envlet/sdk";
await inject();

REST API

Any runtime with an HTTP client can pull values directly. Fetch the full set as JSON or dotenv, or one value by name. Absent and withheld both answer 404.

Terminal

curl -H "Authorization: Bearer $ENVLET_TOKEN" \
  https://api.envlet.dev/v1/values

curl -H "Authorization: Bearer $ENVLET_TOKEN" \
  https://api.envlet.dev/v1/values/STRIPE_KEY

Docker

The CLI works as the production injector: wrap your start command and pass ENVLET_TOKEN in the task definition.

Terminal

RUN npm install -g @envlet/cli
ENTRYPOINT ["envlet", "run", "--"]
CMD ["node", "server.js"]