# Introduction

envpass is a hosted secrets manager for environment variables. It replaces `.env` files that get passed around in chat with one encrypted store that your team, your CI and your servers all read from.

It is free for teams and has a REST API, a Node.js package and a Python package.

## What you get

- **One place for every value.** Secrets are organized by **workspace → project → service → environment**, so `DATABASE_URL` for the `api` service in `prod` is a single, versioned value.
- **Layers instead of copies.** Put shared values in the project's **Shared** layer. Override a value for one service, or just for yourself on a development environment.
- **Access control per environment.** Roles grant `none`, `read` or `write` on each environment, plus management permissions. Developers can write `dev` without ever seeing `prod`.
- **Service tokens for CI.** Tokens are scoped to a project, one or more environments and optionally one service. They are read-only by default and always expire.
- **History and audit.** Every change is a version you can roll back to. Every read and write is recorded in an append-only audit log.
- **Encryption at rest.** Values are encrypted with AES-256-GCM using a separate data key per project and environment.

## How values reach your app

```bash
# on a laptop
bunx envpass-cli login
bunx envpass-cli run -e dev -- bun dev

# in CI, with a service token
ENVPASS_TOKEN=ep_live_... npx envpass-cli pull -e prod
```

```ts
import { loadEnv } from "envpass-cli"

await loadEnv({ environment: "prod" })
```

```python
from envpass import load_env

load_env("prod")
```

## Next steps

- [Quickstart](/docs/quickstart): from sign-up to your first `pull` in a few minutes.
- [Concepts](/docs/concepts): workspaces, projects, services, environments and how values are resolved.
- [CLI](/docs/cli): every command and option.
- [CI/CD](/docs/ci-cd): GitHub Actions, Vercel, Docker and any other pipeline.
- [REST API](/docs/rest-api): authentication, endpoints and errors.