Documentation

EnvShare

EnvShare is one encrypted home for application secrets (API keys, database URLs), scoped to the service and environment that needs them. People manage access in the dashboard. Local processes and CI receive values through the CLI (command-line tool).

How secrets are organized

Workspace
└── Project
    ├── development
    │   ├── DATABASE_URL
    │   └── RESEND_API_KEY
    └── production
        ├── DATABASE_URL
        └── RESEND_API_KEY

• Workspace — team home for members, projects, tokens, and audit history.
• Project — one deployable app or service.
• Environment — an isolated set of values (development, staging, production).
• Secret — a named encrypted value with a safe preview, version history, and related audit events.

Quickstart

1. Create an account and a workspace.
2. Create a project and pick environments.
3. Add secrets, or import a .env file.
4. Invite teammates. You can invite people who do not have an account yet, and cancel a pending invite.
5. Create a token on the Tokens page.
6. Install the CLI and inject secrets at runtime.

node packages/cli/index.mjs login --token es_... --api http://localhost:3000
node packages/cli/index.mjs use -w acme -p atlas-api -e development
node packages/cli/index.mjs run -- npm run dev

CLI

The CLI talks to /api/v1 with a machine token. Prefer envshare run so values live in the child process environment, not in a committed file. Watch mode restarts the process when a secret revision (version) changes.

envshare secrets list
envshare secrets pull --format env --out .env.local
envshare secrets set STRIPE_SECRET_KEY sk_live_...
envshare secrets import --from .env
envshare run --watch -- npm run dev

Security

Values are encrypted with AES-256-GCM (a lock that also checks the data was not changed) before they are stored. Firestore holds ciphertext (the locked bytes), a nonce, an auth tag, and a non-secret preview. The encryption key lives only in server environment variables.

Create, update, delete, import, export, and CLI pulls that return values are written to the workspace audit log. Reveal and copy in the UI are not logged, so they stay fast. Encryption at rest does not replace access control or credential rotation (changing keys when someone leaves).