Overview
Secrets without the .env files.
Replace .env files, key files, and certificates with an encrypted vault that injects them on demand.
api
Everything sensitive, behind Touch ID.
Keep secrets, plain values, certificates and files together, tagged by environment such as dev and prod. Import a .env file, a certificate (pem, crt, cer, key, p12, pfx) or any file, and export back out to .env when you need to.
envchain run [-p project[/env]] [-e env] [--no-inherit-env] -- COMMAND...hands secrets to the process as environment variables, with no .env file created.list,set,import-envandbindmanage the vault from the terminal.Set a Touch ID policy per item: ask on every access, cache the approval, or ask once per daemon session. Projects can override the default, and you choose whether a cached approval covers one item, a project or everything.
Everything sensitive, behind Touch ID.
Every kind of secret, side by side
Keep secrets, plain values, certificates and files together, tagged by environment such as dev and prod. Import a .env file, a certificate (pem, crt, cer, key, p12, pfx) or any file, and export back out to .env when you need to.
Inject without writing files
envchain run [-p project[/env]] [-e env] [--no-inherit-env] -- COMMAND... hands secrets to the process as environment variables, with no .env file created. list, set, import-env and bind manage the vault from the terminal.
$ envchain run -p website/dev -- npm start $
Choose how often to be asked
Set a Touch ID policy per item: ask on every access, cache the approval, or ask once per daemon session. Projects can override the default, and you choose whether a cached approval covers one item, a project or everything.
STRIPE_SECRET_KEY
Auth policy
How often to prompt before reading the value for this item. Other items may still use the project default.
Ask once, then reuse approval for 5 minutes.
Keychain or local vault, with a way back in
New secrets go to the macOS Keychain, optionally synced through iCloud Keychain, or to a local encrypted vault. Generate a 20-character recovery code and type it back to prove you saved it. Vault backups are exported encrypted.
Defaults for new items
Where new secrets are stored unless overridden per item.
Sync Keychain secrets via iCloud Keychain by default.
Database
Run VACUUM to reclaim disk space in the local vault database.
Backup and restore
Exports are encrypted with your vault key. Store your recovery code alongside backups.
A temporary .env for tools that need one
Opt a folder in with a .envchain marker, then build an env file from vault items and plaintext variables. Materialising writes cleartext under the bound folder and it is removed when the TTL elapses. If you decline the auth prompt you get the plain lines only, or an empty file.
Generated env files
Build an env file from vault items and plaintext variables. Materialising writes cleartext under the bound folder; it is removed when the TTL elapses.
$ envchain venv on -p website
virtual .env enabled for project 'website' in /Users/dev/code/websiteSecrets on cd
A zsh, bash or fish hook asks for the bound project when you change directory and emits the export and unset lines for your shell. It needs the CLI and the daemon.
$ cd ~/code/website envchain hook --cwd "$PWD" --shell zsh export LOG_LEVEL='debug' unset OLD_TOKEN
Hook authentication
Hooks only inject after an EnvChain auth session is already cached.
Appends envchain hook to ~/.zshrc - auto-injects secrets on cd
Shell hooks auto-export secrets when you cd into a project directory. Requires CLI and daemon.
Find out why it is not working
envchain doctor checks the daemon plist, daemon connection, auth cache, socket file, CLI on PATH, biometry and code signature, and prints a hint for each failure. Commands exit with 2 for denied auth, 3 for not found and 4 when the daemon is down.
$ envchain doctor [ok] daemon plist: /Users/dev/Library/LaunchAgents/app.coretools.envchain.daemon.plist [ok] daemon running: socket connected, handshake ok [ok] daemon ping: version 1.2.0 [ok] auth cache: active [ok] socket file: /Users/dev/Library/Application Support/envchain/daemon.sock [ok] CLI on PATH: /Users/dev/.local/bin/envchain [ok] biometry available: Touch ID available [ok] binary signed: codesign --verify passed All checks passed.
Keep a team store and your vault in step.
Link HashiCorp Vault, AWS, Azure, GCP, 1Password, Doppler, Infisical or Bitwarden, then pull, push or both. Read-only sync turns the project into a mirror.
Step through each conflict, compare the masked local and remote values, and keep local, use remote or enter your own.
Choose a provider
Connect a secret store to this vault. Secrets will be read and written through EnvChain's sync layer.
Keep a team store and your vault in step.
Connect a secret store
Link HashiCorp Vault, AWS, Azure, GCP, 1Password, Doppler, Infisical or Bitwarden, then pull, push or both. Read-only sync turns the project into a mirror.
Choose a provider
Connect a secret store to this vault. Secrets will be read and written through EnvChain's sync layer.
Resolve one at a time
Step through each conflict, compare the masked local and remote values, and keep local, use remote or enter your own.
Resolve: DATABASE_URL
Pay once. Keep it.
- Licence
- 1 device, or 5 at checkout
- Updates
- Two major versions
- Refund
- Self-serve within 14 days
- Requires
- macOS 12+
