For every platform
Wherever you deploy, the host keeps one secret and pulls the rest at boot.
- VercelOne ENVLET_TOKEN in Vercel project settings. Your functions and server components inject the rest at boot.Set up
- Cloudflare WorkersWorkers have no process.env, so pass the token from your binding to load() and read the returned values.Set up
- AWSLambda, ECS, and EC2 all take one environment variable. ENVLET_TOKEN replaces every other secret you were copying into task definitions.Set up
- Google CloudCloud Run and Cloud Functions take ENVLET_TOKEN as one variable. Everything else comes from Envlet at boot.Set up
- Fly.iofly secrets set ENVLET_TOKEN once, then start the machine through the CLI or inject with the SDK.Set up
- RailwayOne variable in the Railway service, then envlet run in the start command.Set up
- NetlifyFunctions and edge functions read ENVLET_TOKEN from Netlify and load the rest from Envlet.Set up
- GitHub ActionsOne repository secret replaces every other secret in the workflow. Steps run through envlet run and read values the normal way.Set up
- GitLab CIOne masked CI/CD variable, then envlet run in the job script.Set up
- DockerPass one variable into the container and start through envlet run. No .env file baked into the image.Set up