Introduction
Environment secrets, encrypted, scoped, and audited.
Envi is an environment-secret manager: encrypted .env values, scoped access, an audit trail, and a CLI that gets a secret from your database into a running process without anyone typing it into Slack.
It also holds a key-value store your application reads and writes while it runs, which is a separate thing from your secrets — see Key-Value Store.
The CLI and the web dashboard are two clients of one API — neither is a special case. Pull and push .env files from a terminal, or manage the same projects visually. Same backend, same permissions, your choice of interface.
One line for Mac, Linux, or Termux. A PowerShell one-liner for Windows.
QuickstartAuthenticate, create a project, and push your first .env in a few minutes.
Every command — auth, push, pull, diff, share, and the rest.
One credential in your container, no .env in the image.
Manage secrets visually, and copy a whole environment out in one paste.
Self-host itYour own Envi server in one command, free, with your team signing in by password.
What it does
How it fits together
Secrets are encrypted before they reach Postgres and decrypted only in memory, on demand, for a request that has already passed the access-grant check.
Envi is offered as a hosted product, and the whole stack is open source. See Self-Hosting to run it on your own server.