getmyenv
Get started

Encrypted environment variables. No SDK.

Keep using environment variables.Stop managing them as files.

Your app still reads environment variables. Every value is encrypted in the browser or CLI, and we store ciphertext only. npx getmyenv run hands them to your app at start, per context. No code changes.

Start without an account. Then npx getmyenv run [context] -- npm run dev

Run with npx. No global install.docs
No account needed. Claim the project later.

From a .env file to a running app

One set of variables, with a value for each place your app runs. Config and secrets alike. Your app still reads environment variables.

  1. 1.

    Start

    Run it in your project folder. Start without an account, or sign in.

    npx getmyenv
  2. 2.

    Add values

    Import a .env, type them in the dashboard, or fill them from a template link. Values are encrypted before upload.

    npx getmyenv import
  3. 3.

    Run

    Your app starts with its variables. It still reads ordinary environment variables.

    npx getmyenv run -- npm start
  4. 4.

    Another machine

    Run it in the same folder and sign in. Servers read a Read-only context with a server token.

    npx getmyenv
  5. 5.

    Share with a teammate

    Invite by email, with access per context. Your browser seals the keys to their account.

See what your app gets before it starts

run resolves the context, checks every variable and merges it with your shell. A missing value stops the run and names it. --explain prints names and sources, never values.

Run getmyenv where your app starts: your machine, the server, the CI job, or the container's start command. It needs Node 24 or newer there. run is the default. If getmyenv can't run where the app starts, export writes a plaintext .env instead.

Runtime injection docs

Names and sources. Never values.
$ npx getmyenv run staging --explain -- npm start
my-api / Staging (staging)
  API_URL       getmyenv (staging)
  DATABASE_URL  getmyenv (staging)
  LOG_LEVEL     getmyenv (staging)
  PORT          getmyenv (staging), replaces parent env
  STRIPE_KEY    not set (missing in staging)
 
  4 from getmyenv, 1 replaced, 0 kept, 0 from parent env, 1 not set
 
getmyenv: 1 variable has no value in staging:
  STRIPE_KEY
Set it in a terminal: npx getmyenv set --missing -c staging
Or remove it from the project: npx getmyenv unset STRIPE_KEY --all
Or run anyway: --allow-missing

Works where your app already runs

Push a context to your platform, or wrap the command that starts your app. The CLI needs Node 24 or newer where the app starts, also in a Python, Ruby or PHP container.

Push to

The CLI copies a context there with your platform token. Values are decrypted locally. Your token stays on your machine.

Works with

No SDK. run passes ordinary environment variables to the process.

The CLI runs your app. The dashboard holds the rules.

Read-only values, machines and server tokens are managed there.

  • Variables by context

    Each context shows which values are set and which are missing. Values stay encrypted until you reveal one.

  • Approve a machine

    A new machine asks to read a Read-only context. Approve it once, trust it, or deny it.

  • Server tokens

    A server token reads one Read-only context from the IPs you allow.

Encrypted before it leaves your machine

The browser or CLI encrypts each value. We store ciphertext and never see your Vault password. Analytics loads on public pages only. It never loads on sign-in, signup, claim or the dashboard, where the vault unlocks.

SecurityVault modelWhen it fitsRead the CLI code (MIT)

  1. 1

    Your browser or CLI

    Encrypts each value with a context key.

  2. 2

    getmyenv

    Stores ciphertext. Cannot read it.

  3. 3

    run, on your machine

    Decrypts with your key.

  4. 4

    Your app

    Gets ordinary environment variables.

Readable only at the ends. CI and servers take the same path with a server token for a Read-only context.

Who reads the values

People, servers and AI agents each get access their own way. All of them end up with ordinary environment variables.

Approval gives a machine a one-time grant for 1 hour.

Machine access docs

You

Set values in the dashboard or the CLI. You hold the Vault password.

npx getmyenv set API_KEY
A teammate

Accepts your invite and gets the contexts you share. Has their own Vault password. You can remove them and rotate the keys.

npx getmyenv run -- npm run dev
A server

Reads one Read-only context with a server token, from an allowlisted IP. A new machine waits for your approval, or is trusted from an allowed IP if you choose.

npx getmyenv run -- node server.js
An AI agent

Creates a guest project while scaffolding. No account needed. Starts the app with run. You claim the project later.

npx getmyenv guest

A context for each place your app runs

Name them after where your app runs, like Staging or Customer Acme. Each variable has a value per context. New projects start with Development (open) and Production (Read-only).

Read-only: the CLI reads and exports, never writes.

Contexts docs

my-api
  • Development
  • Production
  • Staging
  • Preview
  • Customer Acme
  • New context
ContextAPI_URLCLI
Developmenthttp://localhost:8080Read and write
Productionhttps://api.example.comRead-only
Staginghttps://staging.example.comRead and write
Previewhttps://preview.example.comRead and write
Customer Acmehttps://acme.example.comRead and write
Example project. Development and Production come with every project. The others were added. Same variables in each: API_URL, DATABASE_URL, LOG_LEVEL, PORT, STRIPE_KEY

Works with AI editors

Paste the prompt into Cursor, Claude Code or any agent. It starts without an account, keeps values out of the chat, and hands the project to you to claim.

Set up getmyenv for this project (AI scaffolding, no account):

1. Ask the human once, in one message: where will the app run, and use getmyenv at runtime or as a manager only? Recommend runtime: npx getmyenv run -- <command> passes the values to the process, with no .env file on disk. Manager only: npx getmyenv export writes a plaintext .env for tools that read one, and the scripts stay as they are. Run getmyenv where your app starts: your machine, the server, the CI job, or the container's start command. It needs Node 24 or newer there. run is the default. If getmyenv can't run where the app starts, export writes a plaintext .env instead. If you cannot ask, use runtime for local development.
2. From the project root: npx getmyenv guest --name <project-name>. Guest projects have Development only. Claiming adds Production (Read-only).
3. Add variables: npx getmyenv import (reads .env files in this folder), or npx getmyenv set the way the human chose. In the same message, ask how to enter secret values. First declare the names with no values: npx getmyenv set KEY1= KEY2=. Names are safe to share. Then recommend the hidden prompt: the human runs npx getmyenv set --missing in a terminal and types each value, which never enters the chat. With an account, the dashboard works too. If the human pastes a value in chat instead, it is sent to your AI provider, so tell them to rotate it at its provider afterwards. Values not secret, like LOG_LEVEL, can use set KEY=value. import reads .env files directly. If you cannot ask, declare the names and tell the human to run npx getmyenv set --missing. While guest, claim.json holds the passphrase, so there is no Vault password prompt.
4. Runtime: start the app with npx getmyenv run -- <start command>. Do not wrap the agent itself. With runtime, remove --env-file=.env only from scripts that load that file. run already puts the values in the environment, and node stops with an error when the file is missing. Manager only: npx getmyenv export, and keep the scripts as they are.
5. A missing value stops run and prints its name. Set it, or pass --allow-missing.
6. Commit .getmyenv/project.json and .getmyenv/template.json. token.json and claim.json stay local and are gitignored. Commit the .gitignore changes too.
7. claim.json holds the claim code and guest passphrase until claim. If the folder is lost before claim, the project cannot be claimed. A clone with .getmyenv/template.json can start a new project with the same names. Keep claim.json private. Do not print it, paste it in chat, or add it to git. The human runs npx getmyenv claim in the same folder, and claim reads it. After claim, the context keys are sealed to the human's account.
8. Tell the human to run: npx getmyenv claim, from this folder. After claim, values open with the human's Vault password. The human runs npx getmyenv run -- <start command> once in a terminal to unlock. Then run works without a prompt for 8 hours. A guest project stays active while the CLI uses it. After 30 days without use, or 180 days after it was created, values can't change. For 30 more days, run still works and it can still be claimed. Unclaimed projects may be deleted after that.
9. Docs: https://getmyenv.com/docs/cli and https://getmyenv.com/llms.txt

Guides

Short and runnable. One task each.

All guides
  • The owner keeps the keys in an encrypted project. Developers get Development, and a server token takes Production to the server.

    Oct 14, 2026 · 4 min read

    Hold the API keys your developers need

    You own the Stripe, OpenAI and email accounts. Keep their keys in one project, give developers test keys only, and send live keys to the server, not to people.

  • A .env file sits next to an AI agent. The values move into encrypted storage, and getmyenv run passes them to the app process.

    Oct 10, 2026 · 5 min read

    Your AI agent can read your .env file

    .gitignore keeps .env out of commits, not out of reach of an AI agent in your folder. Move the values out and start the app with getmyenv run.

  • A .env.local file becomes an encrypted padlock, then one terminal command starts a Next.js app.

    Oct 10, 2026 · 4 min read

    Next.js environment variables without .env.local

    Next.js reads process.env before any .env file. Start next dev, next build and next start with npx getmyenv run and drop .env.local.

Open pilot

Accounts created during the pilot stay free, up to 5 projects you own, 10 contexts each. Projects shared with you do not count. No paid plans are live yet. Limits may change.

Get started

Questions

Is getmyenv free?

Open pilot, limits may change. Accounts created during the pilot stay free, up to 5 projects you own, 10 contexts each. Projects shared with you do not count.

No paid plans are live yet.

Do I need an account to start?

No. Run npx getmyenv and choose Start without an account.

A guest project stays active while the CLI uses it. After 30 days without use, or 180 days after it was created, values can't change. For 30 more days, run still works and it can still be claimed. Unclaimed projects may be deleted after that.

Run npx getmyenv claim to keep it.

Is it only for secrets?

No. Put any config in: ports, URLs, flags, keys. Every value is encrypted the same way.

Can secrets and config live together?

Yes. Both are variables in the same context. run starts your app with all of them. Tag variables in the dashboard to filter them.

Where does getmyenv need to run?

Where your app starts. The CLI needs Node 24 or newer where the app starts, also in a Python, Ruby or PHP container. If it can't run there, export writes a plaintext .env.

Does run need the network?

Yes. run fetches the values from getmyenv each time it starts. If it can't reach the server, the command does not start. A running process keeps its values.

How does Production differ from Development?

New projects start with Development (open) and Production (Read-only). Guest projects have Development only. Claiming adds Production (Read-only).

Only the owner sets Read-only values, in the dashboard.

The CLI reads Production with a server token, from an allowlisted IP, on a trusted or approved machine. All three are required.

A server token's New machines rule can also trust machines from allowed IPs.

Can I share a project?

Yes. Invite a teammate by email and pick which contexts they get, read or write. Only the owner sets Read-only values, in the dashboard.

  • Your browser seals each context key to their public key the next time you unlock the vault.
  • Comparing key fingerprints is optional and confirms the key is theirs.
  • Removing a member rotates the keys by default.
  • You can also transfer a project to a member.
How do I export or delete my data?
  • Download an encrypted backup of a project.
  • Export one context as a .env with npx getmyenv export.
  • Delete account in Settings removes your account and the projects you own.
Does it work with 1Password or other tools?

Yes. getmyenv reads the parent environment, so you can chain: op run -- npx getmyenv run staging -- npm start.

Use --keep-existing to let parent values win.

Does it work with Vercel or Netlify?

Yes. npx getmyenv push vercel or npx getmyenv push netlify copies a context there with your platform token. The CLI decrypts locally. Your token stays on your machine.

That copy lives on the platform. Future changes in getmyenv are not pushed automatically.

Does it work with Docker Compose?

Yes. Wrap the command: npx getmyenv run production -- docker compose up -d.

If a tool reads a .env file, write one with npx getmyenv export.

Which languages work?

Any language that reads environment variables. First-class examples: Node, Python, Ruby, Rust, Go, and PHP. Java, .NET, and shell scripts work the same way.

So do Next.js, Vite, Laravel, Rails, Prisma, Turborepo and PM2: wrap the command that starts or builds the app.

What does getmyenv store?

We store:

  • Ciphertext
  • Sealed context keys
  • Your private key, wrapped with your Vault password
  • If you have a recovery code, a separate copy wrapped with it
  • Names: projects, contexts, variables

Never your Vault password, your recovery code or readable values.

Where does encryption happen?

In the browser or CLI.

When do I enter the Vault password?
  • In the browser, once per tab for all your projects, until you lock, reload, or close it.
  • In the CLI, once per project every 8 hours on each machine. Unlocked context keys stay in the OS keychain for 8 hours, or until npx getmyenv lock.
  • Servers and CI use a server token, which holds its context key and never asks.

We never store your Vault password. We store an encrypted key blob.

How do I enter secret values with an AI agent?
  1. The agent declares the names with no values: npx getmyenv set KEY1= KEY2=.
  2. In a terminal, you run npx getmyenv set --missing. Type each value. It never enters the chat.

With an account, the dashboard works too. A value pasted in chat is sent to the AI provider, so rotate it afterwards.

What if I forget the Vault password?

We cannot recover your Vault password. Your recovery code lets you set a new one and keeps every value.

Without the recovery code, you can reset the vault. Names, contexts and members stay, and you set your values again. The Vault model docs cover backups and resets.

Can I expire a value?

Yes. After the date, getmyenv stops providing it. The credential still works at its provider until you rotate it there.