Run the CLI

The getmyenv CLI runs through npx. Every command in the docs starts with npx getmyenv.

npx getmyenv --help  # list commands

The first run downloads the CLI into your npx cache. The npm package is getmyenv. Version 0.14.0 or newer is required. Older versions are asked to update.

If a command prints nothing, another npx getmyenv is still running. npx locks its cache, so the new one waits. Close the other one and run again. A request that takes more than a second prints Contacting and the server address.

• Node.js 24 or newer
• A terminal on macOS, Linux, or Windows
• No account needed to start. An account is needed to claim a guest project or add read-only contexts.

Run npx getmyenv with no command in your project folder. It asks how to start: without an account, or signed in. Then it asks for a project or context name, offers to import the .env files it finds, and prints the run command.

cd your-project
npx getmyenv                     # setup, or status once linked
npx getmyenv run -- npm run dev  # start your app with its variables

Sign in opens the browser. You pick or create a project, and the folder gets a token for open contexts in .getmyenv/token.json. Without a terminal (CI, scripts), bare npx getmyenv prints next steps and exits. It never waits for input.

run --explain lists each variable and where its value comes from. It never prints values.

npx getmyenv run --explain             # this folder's context
npx getmyenv run production --explain  # with a server token

To check one variable reaches your app, without printing it:

npx getmyenv run -- node -e "console.log(process.env.API_KEY ? 'API_KEY is set' : 'API_KEY is missing')"

The same line works in bash, zsh, PowerShell and cmd.

Read-only contexts, such as Production, use a server token. Create one in settings, Tokens. It is bound to one context, is read-only, and needs an IP or CIDR allowlist. Its New machines rule decides whether a new machine asks for approval, is trusted from an allowed IP, or is blocked. If the machine connects over IPv6, add its IPv6 range too, like 2001:db8::/64.

export GETMYENV_TOKEN=...          # macOS, Linux
$env:GETMYENV_TOKEN="..."          # Windows PowerShell
npx getmyenv run -- node server.js

The token carries its own key for this one context. Machines that use it never need your Vault password. We store the token's public key and the context key sealed to it. The key part of the token never leaves the machine. Your browser seals the key to the token when you create it, so the vault must be unlocked then.

To set a value without putting it in the command line, pipe it with set KEY --stdin. Server tokens are read-only, so this needs a folder token.

printf %s "$VALUE" | npx getmyenv set API_KEY --stdin

• GETMYENV_TOKEN uses this token instead of .getmyenv/token.json.
• GETMYENV_API_URL points the CLI at another server. It must use https, or http on localhost.
• GETMYENV_MACHINE_LABEL names this machine on the Requests page. Default: user@host.
• GETMYENV_CONFIG_DIR holds the machine key and cache. Default: ~/.config/getmyenv. In containers and CI, point it at a persistent volume so the machine stays the same across runs.
• GETMYENV_SKIP_UPDATE=1 turns off the update check. It is also off when CI is set.
• GETMYENV_KEYCHAIN=0 never keeps unlocked context keys in the OS keychain. The keychain is also off when CI is set.