Tools

CI/CD

Service tokens with GitHub Actions, Vercel, Docker and plain HTTP.

Pipelines authenticate with a service token. Create one under Project → Tokens:

Pick the environments it may read (and optionally one service).
Keep it read-only unless the job writes values.
Choose an expiry: 30, 90 or 365 days.

The token is shown once. Store it in your CI's secret store as ENVPASS_TOKEN. A token stops working when it expires, when it is revoked, or when the person who created it leaves the workspace.

GitHub Actions

YAML

jobs:
  deploy:
    runs-on: ubuntu-latest
    env:
      ENVPASS_TOKEN: ${{ secrets.ENVPASS_TOKEN }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npx envpass-cli pull -e prod -s api -o .env
      - run: npm run build

Or inject values for a single step without writing a file:

YAML

      - run: npx envpass-cli run -e prod -- npm test

Vercel, Netlify and other build platforms

Add ENVPASS_TOKEN to the project's environment variables, then pull before the build:

JSON

{
  "scripts": {
    "build": "envpass-cli pull -e prod -o .env.production && next build"
  },
  "devDependencies": {
    "envpass-cli": "latest"
  }
}

Docker

Pass the token at runtime and let the container resolve values on start:

Dockerfile

FROM node:22-slim
WORKDIR /app
COPY . .
RUN npm ci && npm install -g envpass-cli
CMD ["envpass", "run", "-e", "prod", "--", "node", "server.js"]

Terminal

docker run -e ENVPASS_TOKEN=ep_live_... my-image

Avoid baking secrets into image layers. Resolve them when the container starts.

Python services

Terminal

uvx envpass-cli run -e prod -- gunicorn app:app

Plain HTTP

Any tool that can make an HTTP request can read values:

Terminal

curl -fsS -H "Authorization: Bearer $ENVPASS_TOKEN" \
  "https://envpass.dev/api/v1/resolve?environment=prod&format=dotenv" > .env

format can be dotenv, shell (export KEY='value' lines for eval) or json.