CLI documentation

Run any command with the right environment.

Select a project and environment once, then resolve it for a developer, agent, or CI job under that identity's policy.

Install, sign in, select, and run

Use Node.js 22 or later on macOS or Linux. Run project commands from inside a Git repository.

Install

Install Envlet from npm

Install the package globally to make the envlet command available in your terminal.

Terminal

npm install -g @envlet/cli

Complete the device code flow

Envlet prints a browser URL and device code, then waits for approval. A successful login saves a time-limited credential in ~/.envlet/credentials.json with file mode 0600.

Terminal

envlet login

Init

Bind the repository to one environment

Run this inside a Git repository. Choose a project and environment. Envlet writes their names and stable IDs to .envlet at the repository root. The file contains no secret values and can be committed. Use --force only when you need to replace an existing selection.

Terminal

envlet init [--force]

Run

Inject the resolved environment

The -- separator is required. Envlet resolves the selected project and environment, applies the active identity's policy, and starts the command with those variables.

Terminal

envlet run -- <command> [args]

List

Print the resolved variable names

List the variable names available to the active identity in sorted order. Add --values to include each resolved value.

Terminal

envlet list [--values]

Pull

Write the resolved values to .env

Write the selected environment to a local .env file with file mode 0600. Envlet refuses to replace an existing file unless you pass --force. Keep the file out of Git and load it with a dotenv-compatible tool.

Terminal

envlet pull [--force]

Set

Set a shared value or identity override

Create or update a shared variable in the selected environment. Add --as <identity> to set an override for an identity that already has a grant for that environment.

Terminal

envlet set KEY=value [--as <identity>]

CI and agents

Use one token for one project and one environment

Give each CI job or agent the token for the environment it must resolve. Use separate tokens for staging and production.

Mint one environment token

In the dashboard, choose the identity, project, environment, and expiry. Envlet shows the raw token once and stores only its digest.

Store it outside the repository

Save the raw token in the secret store for the CI job or agent. Export it as ENVLET_TOKEN when that process starts.

Resolve the matching .envlet

The token can resolve only the project and environment in its scope. That scope must match the stable IDs in the repository's .envlet file.

Start the command without the token

Envlet applies the identity's set, override, and withhold policy, audits the resolved key names, and removes the ENVLET_TOKEN credential from the inherited environment before the child process starts.

Export the token before Envlet starts

ENVLET_TOKEN takes precedence over the credential saved by envlet login. Keep it in the CI or agent secret store, not in the repository. The child command receives the resolved variables, but it does not receive the inherited token.

Terminal

export ENVLET_TOKEN="paste-the-token-here"
envlet run -- npm test

Run in production

Your platform holds one secret, ENVLET_TOKEN. The app pulls everything else from Envlet at boot.

Node SDK

Install @envlet/sdk and call inject() before your app reads its configuration. Values already set by the host are never overwritten. load() returns the values as an object and also works in edge runtimes.

Terminal

npm install @envlet/sdk

// at the top of your entrypoint
import { inject } from "@envlet/sdk";
await inject();

REST API

Any runtime with an HTTP client can pull values directly. Fetch the full set as JSON or dotenv, or one value by name. Absent and withheld both answer 404.

Terminal

curl -H "Authorization: Bearer $ENVLET_TOKEN" \
  https://api.envlet.dev/v1/values

curl -H "Authorization: Bearer $ENVLET_TOKEN" \
  https://api.envlet.dev/v1/values/STRIPE_KEY

Docker

The CLI works as the production injector: wrap your start command and pass ENVLET_TOKEN in the task definition.

Terminal

RUN npm install -g @envlet/cli
ENTRYPOINT ["envlet", "run", "--"]
CMD ["node", "server.js"]