Machine access

The CLI keeps one machine key pair per project on each machine, in machines/ under GETMYENV_CONFIG_DIR (default ~/.config/getmyenv). It identifies the machine. It does not decrypt values. In containers and CI, point GETMYENV_CONFIG_DIR at a persistent volume, or each run is a new machine. Open contexts approve machines automatically. Trust is per Read-only context: a machine trusted for a context reads it without asking. Other machines follow the server token's New machines rule.

Set the rule when you create a server token in Project settings, Tokens, or change it later with Edit access.

• Ask me (default): the first read creates a request on Requests.
• Trust from these IPs: the first read from an allowed IP trusts the machine for this token's context only. We email you. Every allowlist entry must be /24 or narrower (IPv6 /64). If the allowlist gets wider, the token asks instead.
• Blocked: the read is refused. Trust the machine on Requests to let it in.

The IP allowlist is checked first. A read from an IP not on it is refused, even from a trusted machine. Every such read is refused. Activity shows TOKEN_IP_DENIED with the token label and the IP, at most once per token per hour. If the machine connects over IPv6, add its IPv6 range too, like 2001:db8::/64.

• Request: run on a read-only context creates a request and prints the Requests page link. A machine's request waits up to 5 minutes for approval.
• Approve: you approve or deny on Requests. The request shows project, context, and machine name.
• Grant: approval gives that machine a one-time grant, valid for 1 hour.

Approve with Trust to skip approval for that machine later. It covers that context only. Other Read-only contexts still ask. The Requests page lists every machine with its status. Trust there covers every Read-only context in the project. Trust, untrust, or revoke at any time.

A revoked machine cannot read values. Revoking stops new reads. A running process keeps the values it started with until it restarts. To register again from that machine, delete machines/<project id>.json in its config directory. After a revoke, a new machine on the same token asks for approval, even when the server token trusts machines from its allowed IPs. To cut a server off, revoke its token too.

Servers that run Docker Compose: /docs/docker.

• Revoke its server token in Project settings, Tokens.
• Revoke the machine on the Requests page.
• Stop or replace the server. Revoking stops new reads. A running process keeps the values it started with until it restarts.
• Rotate each credential at its provider. Revoking stops getmyenv from providing values. A credential the server already read works until you rotate it there.
• Set the new values in the Read-only context. Only the owner sets Read-only values, in the dashboard.
• Make a new server token for the replacement server. Check Last seen on the Requests page for machines you don't recognize.