Introduction
Environment secrets, encrypted, scoped, and audited.
Envi is an environment-secret manager: encrypted .env values, scoped access, an audit trail, and a CLI that gets a secret from your database into a running process without anyone typing it into Slack.
The CLI and the web dashboard are two clients of one API — neither is a special case. Pull and push .env files from a terminal, or manage the same projects visually. Same backend, same permissions, your choice of interface.
One line for Mac, Linux, or Termux. A PowerShell one-liner for Windows.
QuickstartAuthenticate, create a project, and push your first .env in a few minutes.
Every command — auth, push, pull, diff, share, and the rest.
Run the entire stack yourself. Nothing is held back for a separate build.
What it does
How it fits together
Secrets are encrypted before they reach Postgres and decrypted only in memory, on demand, for a request that has already passed the access-grant check.
Envi is offered as a hosted product, and this documentation covers the same stack behind it — self-hosting is a first-class option, not a separate "enterprise" build. See Self-Hosting if you'd rather run it yourself.