Tools

CLI

envpass-cli commands for Bun, Node.js and Python: login, link, pull, run.

The CLI is published as envpass-cli on npm and PyPI. Both packages install a command named envpass and behave the same way, and they share login credentials.

Terminal

bunx envpass-cli <command>    # Bun
npx envpass-cli <command>     # Node.js 20+
uvx envpass-cli <command>     # Python 3.9+ with uv
pipx run envpass-cli <command>

Install globally to get the shorter envpass command:

Terminal

npm install -g envpass-cli    # or: pip install envpass-cli
envpass pull

Commands

Signs in through your browser using the OAuth device flow and saves a token to ~/.config/envpass/credentials.json (file mode 600).

Terminal

envpass login
envpass login --no-browser    # over SSH: prints the link instead of opening it

logout

Revokes the CLI session on the server and removes the saved token.

whoami

Shows the user or service token the CLI is using.

link

Saves default scope to .envpass.json in the current directory. The file contains slugs only and is safe to commit.

Terminal

envpass link -w acme -p shop -e dev -s api

pull

Writes the resolved values for one environment (and optionally one service) to a file.

Terminal

envpass pull                     # .env, using .envpass.json
envpass pull -e prod -o .env.production
envpass pull -e prod -o -        # stdout
envpass pull -e prod -f json     # json or shell exports

Files are written with mode 600.

run

Runs a command with the values injected as environment variables. Values that appear in the command's output are replaced with ***.

Terminal

envpass run -e dev -- bun dev
envpass run -e staging -s worker -- python worker.py
envpass run --no-mask -e dev -- printenv

The exit code of the command is passed through.

Options

Option	Environment variable	Description
`-w, --workspace`	`ENVPASS_WORKSPACE`	Workspace slug. Not needed with a service token.
`-p, --project`	`ENVPASS_PROJECT`	Project slug. Not needed with a service token.
`-e, --env`	`ENVPASS_ENV`	Environment slug, for example `dev` or `prod`.
`-s, --service`	`ENVPASS_SERVICE`	Service slug, or `shared` for the Shared layer only.
`-o, --out`		`pull` output file, `-` for stdout. Default `.env`.
`-f, --format`		`pull` format: `dotenv`, `shell` or `json`.
`--url`	`ENVPASS_URL`	Server URL. Default `https://envpass.dev`.
	`ENVPASS_TOKEN`	A service token (`ep_live_...`) or CLI session token.

Scope is resolved from flags first, then environment variables, then the nearest .envpass.json.

Exit codes

Code	Meaning
0	Success
1	Error (not signed in, forbidden, not found, invalid input)
127	`run` could not start the command
other	`run` passes through the command's exit code