Secrets for real apps
Keep using environment variables. Just stop managing them as files.
.env works. Until you have to manage it across machines, teammates, and deploys. getmyenv sits under your process - same env vars, no SDK, no rewrite.
- .env
- getmyenv
- encrypted secrets
- getmyenv run
- your app
npx getmyenv run -- python app.py
Same command, every language
Inject secrets, then run your app. No SDK in any of these.
Node
npx getmyenv run -- npm start
Python
npx getmyenv run -- python app.py
Ruby
npx getmyenv run -- ruby app.rb
Rust
npx getmyenv run -- cargo run
Go
npx getmyenv run -- go run .
PHP
npx getmyenv run -- php app.php
.env is a good interface. A weak management system.
Past one developer and one machine, files stop scaling. getmyenv is the layer in between - still environment variables at the end.
01
From .env files to one command
init finds names and creates dashboard placeholders. migrate (or add) fills encrypted values. Your app still reads environment variables - no rewrite.
02
Encrypted client-side. Same APIs.
You set a Vault password. Encryption happens in the browser or on your machine. Your code still reads environment variables.
03
Simple or Advanced. No SDK.
Browser encryption for speed, or CLI encryption for maximum control. getmyenv sits underneath your process - no rewrite.
04
Machine access and webhooks
Approve machine access. Requests expire in 5 minutes; grants last 1 hour and are one-time. Notify Zapier, Make, or your app when those events happen.
Client encrypts. We store ciphertext.
Envelope encryption with named primitives. Details live in the docs - not the pitch.
Two protection modes
Pick Simple for the dashboard, or Advanced for the CLI.
- Immediate setup in the dashboard
- Browser encryption before upload
- Simple day-to-day workflows
Secrets encrypt in your browser before upload. We store ciphertext only - never your Vault password or plaintext.
- CLI encrypts locally before upload
- Encrypted local backups
- Local decryption and control
The CLI encrypts on your machine. We store and deliver ciphertext only - never readable secret values.
Common questions
Straight answers about what getmyenv does and does not do.
- Is getmyenv free?
- Open pilot. Early adopters get a lifetime free account with up to 5 projects. No paid plans are live yet.
- Does my app need a getmyenv SDK?
- No. Your application does not need a getmyenv SDK. Secrets are injected as environment variables before your process starts.
- Which languages work?
- Any language that reads environment variables. First-class examples: Node, Python, Ruby, Rust, Go, and PHP. Java, .NET, and shell scripts work the same way.
- What does getmyenv store?
- Ciphertext and a wrapped project key blob. We never store your Vault password or plaintext secret values.
- What is Simple vs Advanced?
- Simple encrypts in the browser. Advanced encrypts on your machine via the CLI. Same envelope protocol either way.
- Do I unlock on every device?
- Yes. Unlock on each device. Your Vault password stays on that device; we store an encrypted key blob.
- What happens after secrets load?
- After a secret is loaded into your app process, that process holds it. getmyenv does not control what your code logs or forwards.
- Can I revoke or expire a secret?
- Yes in getmyenv - we stop providing it. That does not revoke or invalidate the credential at a third-party provider.
Open pilot
Early adopters get a lifetime free account, up to 5 projects. No paid plans are live yet.
Built for AI-built apps
Same environment variables, same vault. No SDK, no rewrite.
Prompt for AI editors
Paste into Cursor or your coding agent to wire getmyenv into a project.
Set up getmyenv for this project:
1. Sign up at https://getmyenv.com (open pilot - lifetime free for early adopters, up to 5 projects).
2. Create a project. Pick Simple (encrypt in the browser) or Advanced (encrypt with the CLI).
3. In the dashboard, open CLI and create a token. Then: npx getmyenv login
(Or skip login - migrate/init will ask you to paste the token and save it. Login may offer to run migrate.)
4. Detect names and create dashboard placeholders:
npx getmyenv init
(Requires a linked project from migrate, or create the project first then link.)
5. User fills values in the dashboard (Simple) or:
npx getmyenv migrate
(Searches this folder tree for .env* files including .env.example / .env.sample, lists candidates.)
Or a specific file: npx getmyenv migrate --file .env.production -e production
Or one key: npx getmyenv add KEY_NAME
6. Run with secrets injected - no SDK, no code changes:
npx getmyenv run -- <your start command>
Use -e production when needed (CLI env names are lowercase).
Examples: npx getmyenv run -- npm start
npx getmyenv run -- python app.py
7. Do not bake production keys into app source. Production is an environment scope, not a hardcoded key.
8. Docs: https://getmyenv.com/docsMake getmyenv part of your workflow.
Pick events like secret created or revoked. We POST names and metadata only - never secret values.