Platforms

One environment variable per host.

Set ENVLET_TOKEN where the platform keeps secrets. Everything else arrives when the process starts, and rotates in one place.

ENVLET_TOKEN

PlatformKeep the one secretThen

vercel env add ENVLET_TOKEN production

wrangler secret put ENVLET_TOKEN

aws lambda update-function-configuration \
  --function-name api \
  --environment "Variables={ENVLET_TOKEN=envlet_...}"

gcloud run services update api \
  --update-env-vars ENVLET_TOKEN=envlet_...

fly secrets set ENVLET_TOKEN=envlet_...

railway variables --set ENVLET_TOKEN=envlet_...

netlify env:set ENVLET_TOKEN envlet_... --context production

gh secret set ENVLET_TOKEN < ~/.config/envlet/tokens/ci-staging.token

glab variable set ENVLET_TOKEN --masked --value "$(cat ~/.config/envlet/tokens/ci-staging.token)"

docker run -e ENVLET_TOKEN=envlet_... acme/api

Stop pasting .env files.

One command. The right values for whoever runs it.