# getmyenv

> Encrypted environment variables for any language. No SDK.

getmyenv stores secrets as ciphertext. Encrypt in the browser or CLI. We never see plaintext or your vault password. Your app still reads normal env vars.

Website: https://getmyenv.com
Docs: https://getmyenv.com/docs
CLI: npx getmyenv
Security: https://github.com/yobotn/getmyenv/blob/main/SECURITY.md

## Product model

- One vault model: vault password per project. Client-side encrypt/decrypt only.
- Per-project CLI tokens: Development or Production (pick one).
- Development: auto-grant for owner; may cache wrapped key locally; push/pull/restore OK.
- Production: read-only CLI (run / backup). Dashboard for values. Approval + IP allowlist. Never caches the key.
- Push lists .env* files and skips any basename containing production.
- link may offer push when a pushable .env* exists.
- Daily Development prefers run (no local .env). pull only when a tool needs a file.
- push and pull ask for token and link if missing.
- Forget password and lose backup = vault is unrecoverable.

## Quick start

1. Sign up at https://getmyenv.com and create a project.
2. Create a CLI token at /cli (project + Development or Production).
3. In your repo:

```bash
npx getmyenv token               # paste per-project token
npx getmyenv link                # link this folder to the project
npx getmyenv run -- npm run dev  # start app with secrets as env vars
# optional migrate once:
npx getmyenv push                # upload a local .env once (skips *production*)
# optional file for tools that need one:
npx getmyenv pull                # Development only
```

## CLI verbs

token, link, push, pull, run, whoami, backup, restore

## Optional

- Docs: https://getmyenv.com/docs/cli
- Share template from the dashboard: Development secret names only (no values, no password).