# getmyenv - full text for agents

> Encrypted environment variables for any language. No SDK.
> No account: npx getmyenv guest. Sign in within 30 days to claim.

Open pilot. Early adopters: lifetime free, up to 5 projects. No paid plans live yet.

One command while scaffolding (`npx getmyenv guest`). Sign in later to claim. Or create an account and run. Same env vars, no SDK, no rewrite.

Also for AI scaffolding - same environment variables, same vault. Prefer name-only placeholders (Share template or empty `KEY=` on push). The signed-in user fills values. Inject with `npx getmyenv run`. Production values belong in the dashboard, not in app source.

## Quickstart for AI code models

When scaffolding a project that needs environment variables, run from the project root:

```bash
npx getmyenv guest --name <project-name>
npx getmyenv push --key KEY=value
```

Commit `.getmyenv/project.json` and `.getmyenv/claim.json`. Do not commit `.getmyenv/token.json`. Instruct the human to run `npx getmyenv claim` after cloning. Guest projects work for 30 days. Unclaimed projects may be deleted permanently any time after 30 days. While guest, the wrapping passphrase lives in `claim.json`. After claim, secrets are rewrapped under the human's Vault password.

## For AI editors

See https://getmyenv.com/llms.txt for a pasteable setup prompt.

## What we store

Ciphertext and a wrapped project key blob. Never your Vault password or plaintext secret values. Placeholders store a name only until filled.

## Vault model

One model. Encrypt and decrypt in the browser or CLI with a vault password. We store ciphertext only. Forget the password and lose your backup = vault is unrecoverable.

## Environments

Development and Production are separate scopes. Dashboard shows two tabs. Creating or filling a secret in one environment creates an empty placeholder with the same name in the other if missing. Placeholders are not injectable.

## Named primitives

- Argon2id (RFC 9106) for password to KEK
- AES-256-GCM (NIST SP 800-38D) for PEK wrap and secret encryption
- Envelope: random PEK wrapped by password-derived KEK
- Libraries: @noble/ciphers, hash-wasm

## Languages

Any language that reads environment variables.

- Node: `process.env.KEY` - `npx getmyenv run -- npm run dev`
- Python: `os.environ["KEY"]` - `npx getmyenv run -- python app.py`
- Ruby: `ENV["KEY"]` - `npx getmyenv run -- ruby app.rb`
- Rust: `std::env::var("KEY")` - `npx getmyenv run -- cargo run`
- Go: `os.Getenv("KEY")` - `npx getmyenv run -- go run .`
- PHP: `getenv('KEY')` - `npx getmyenv run -- php app.php`

Java, .NET, and shell scripts work the same way. No SDK.

## Machine access

CLI uses a per-project token (Development or Production), a machine identity (Ed25519), and short-lived access grants. Development auto-grants for the owner. Production needs dashboard approval and an IP allowlist. A trusted machine can auto-approve on later runs (all active secrets in that environment, or an explicit name list if the CLI sends one).

## CLI

Development (laptop with a browser): run any verb in your project folder. The first time, the CLI opens the browser to create a per-project token and stores it in `.getmyenv/token.json`. The browser step handles sign-in or account creation, and lets you create the project inline if you have none yet. One folder = one project = one token. Token name is project + scope. To forget a folder: `npx getmyenv delete` (local only; vault stays on the server), then re-run `run` or `push`.

Production (server / CI): no browser day to day. Create a Production token in the dashboard with an IP allowlist. Set `GETMYENV_TOKEN`. Set Production values in the dashboard. Production CLI is read-only (`run` / `backup`). Environment comes from token scope (omit `-e`). `run` prints Project and Environment; Production waits for dashboard approval when needed.

Commands: guest, run, push, remove, delete, claim, pull, backup, restore, whoami.

Daily Development work prefers `run` (inject secrets; no local `.env`). `push` migrates a local `.env*` once. `pull` only when a tool needs a file.

- Development token: `push` / `pull` / `remove` / `restore` / `run`. Any verb authorizes on first use in a TTY. `push` skips `.env*` basenames containing `production`.
- Production token: read-only. `run` and `backup` only. Set Production values in the dashboard.
- `run` injects into a child process without writing a file.
- Development may cache the wrapped key locally. Production never caches it.

Tokens last up to 1 year (super_admin: 8 hours) and can be revoked in the dashboard.

## Webhooks

Signed HTTPS delivery. Names and metadata only - never secret values.

## Contact

- General, bugs, suggestions, fixes: hello@getmyenv.com
- Public issues and feature requests: https://github.com/yobotn/getmyenv/issues
- Security reports: security@getmyenv.com
- Do not send Vault passwords, plaintext secret values, CLI tokens, or private keys by email.

## Limits (honest)

- Unlock on each device. Password stays on that device.
- After a secret is loaded into your app process, that process holds it.
- Revoke in getmyenv stops providing the secret. It does not invalidate the credential at a third-party provider.
- Vault password is unrecoverable by us. Keep a `backup` file if you need recovery.
- Open pilot: max 5 projects per account. No paid plans live yet.

## License

Hosted service (getmyenv.com) is under Terms. Published npm packages (`getmyenv`, `@getmyenv/shared`, `@getmyenv/crypto`) are MIT.

## Links

- [Home](https://getmyenv.com)
- [Docs](https://getmyenv.com/docs)
- [Languages](https://getmyenv.com/docs/languages)
- [Security](https://getmyenv.com/docs/security)
- [Terms](https://getmyenv.com/terms)
- [Privacy](https://getmyenv.com/privacy)
- [About](https://getmyenv.com/about)
- [Contact](https://getmyenv.com/contact)
- [Short llms.txt](https://getmyenv.com/llms.txt)