Introduction

envpass is a hosted secrets manager for environment variables. It replaces .env files that get passed around in chat with one encrypted store that your team, your CI and your servers all read from.

It is free for teams and has a REST API, a Node.js package and a Python package.

What you get

• One place for every value. Secrets are organized by workspace → project → service → environment, so DATABASE_URL for the api service in prod is a single, versioned value.
• Layers instead of copies. Put shared values in the project's Shared layer. Override a value for one service, or just for yourself on a development environment.
• Access control per environment. Roles grant none, read or write on each environment, plus management permissions. Developers can write dev without ever seeing prod.
• Service tokens for CI. Tokens are scoped to a project, one or more environments and optionally one service. They are read-only by default and always expire.
• History and audit. Every change is a version you can roll back to. Every read and write is recorded in an append-only audit log.
• Encryption at rest. Values are encrypted with AES-256-GCM using a separate data key per project and environment.

How values reach your app

# on a laptop
bunx envpass-cli login
bunx envpass-cli run -e dev -- bun dev

# in CI, with a service token
ENVPASS_TOKEN=ep_live_... npx envpass-cli pull -e prod

import { loadEnv } from "envpass-cli"

await loadEnv({ environment: "prod" })

from envpass import load_env

load_env("prod")

Next steps

• Quickstart: from sign-up to your first pull in a few minutes.
• Concepts: workspaces, projects, services, environments and how values are resolved.
• CLI: every command and option.
• CI/CD: GitHub Actions, Vercel, Docker and any other pipeline.
• REST API: authentication, endpoints and errors.