Git for your secrets.

Initialize your identity

$ envctl init

Generates your keypair. This is your identity across all projects.

Create a project

$ envctl project create

Sets up envctl in your current directory.

Add secrets

$ envctl env var set API_KEY=sk_live_...

Secrets are encrypted immediately with your key.

Invite your team

$ envctl project invite alice@example.com
Share this with your teammate:
  envctl join abc123...

Teammates join with a single command.

Use your secrets

$ envctl env use prod
✓ .env written (2 secrets)

Materializes decrypted .env file for your current session.

Or run commands without writing secrets to disk:

$ envctl env apply -- npm start

List environments

$ envctl env list
Environments for 'myproject':

* dev          (3 members) [default]
  staging      (2 members)
  prod         (1 member)

See all environments and who has access. The asterisk marks your current environment.

Create a new environment

$ envctl env create qa
✓ Created environment 'qa'

Add environments as your project grows. New members get access to default environments only.

Switch environments

$ envctl env use staging
✓ .env written (5 secrets)

Decrypts and writes secrets for the selected environment to your .env file.

Run without .env file

$ envctl env apply -e prod -- ./deploy.sh
Passphrase:
✓ Running with 8 secrets

For extra security, run commands with secrets injected directly into the process environment. No .env file is written to disk—secrets exist only in memory for the duration of the command.

Interactive shell with secrets

$ envctl env shell -e staging
Passphrase:
Starting zsh with 5 secrets from myproject/staging
Type 'exit' to leave and clear secrets from memory.

$ echo $API_KEY
sk_live_...
$ exit

Exited envctl shell. Secrets cleared from memory.

Start an interactive shell session with secrets loaded. Your normal shell (bash, zsh, PowerShell) starts with secrets available. Type 'exit' when done—secrets are cleared from memory automatically.

Delete an environment

$ envctl env delete old-env --force
✓ Deleted environment 'old-env'

Remove environments you no longer need. Use --force if members still have access.

Local overrides

$ cat .env.dev
DATABASE_URL=postgres://localhost/mydb
DEBUG=true

$ envctl env use dev
✓ .env written (5 secrets)
Applied 2 override(s) from .env.dev

Create a .env.<environment> file (e.g., .env.dev) to override shared secrets with personal settings. Local overrides take precedence over secrets from the ops chain. This is useful for local database URLs, debug flags, or other per-developer settings that shouldn't be shared. Use --no-overrides to ignore local override files.

Generate a CI keypair

$ envctl ci keygen
Generated CI keypair for project "myproject"

Public key stored on project chain (committed)

CI Private Key (store in your CI platform's secrets as ENVCTL_CI_KEY):

Kz4xN2U5...base64...

This private key will NOT be shown again.
Store it securely in your CI platform now.

Generate an ML-KEM-768 keypair. The public key is stored on the team chain and synced to all project members. The private key is shown once—store it in your CI platform's secrets.

Export encrypted bundle

$ envctl ci export -e prod -o .envctl/prod.enc
Identity passphrase:
Exported 8 variables to .envctl/prod.enc

Export your secrets as an encrypted bundle using the public key. Any team admin can export—no need to share the CI private key. Safe to commit to your repository.

Use in CI pipelines

# GitHub Actions example
- name: Run tests with secrets
  env:
    ENVCTL_CI_KEY: ${{ secrets.ENVCTL_CI_KEY }}
  run: envctl ci apply -b .envctl/prod.enc -- npm test

Decrypt and run commands with secrets injected. No daemon or identity required—just the bundle and CI private key. Secrets exist only in memory during execution.

Update secrets

$ envctl env var set -e prod NEW_API_KEY=sk_live_...
$ envctl ci export -e prod -o .envctl/prod.enc
$ git add .envctl/prod.enc && git commit -m "Update prod secrets"

When secrets change, re-export the bundle and commit. Any team admin can export without needing the CI private key. Git history shows when secrets changed.