CLI Reference

Every envi command.

envi <command> [flags]

Every command that touches your account first checks for a stored session (envi auth), then talks to the API directly — the CLI never needs the web dashboard running.

Authentication

`envi auth`

Signs in. By default this is the browser device flow: it prints a code, opens your browser, and waits for you to approve it there.

envi auth

--emailstring

Skip the browser and sign in with an emailed one-time code instead. Prompts for the code interactively.

--no-browserboolean

With the device flow, print the approval URL instead of trying to open a browser — useful over SSH.

envi auth --email you@company.com

`envi logout`

Revokes the current device's session.

envi logout

Project setup

`envi init`

Links the current directory to a project and environment, writing envi.toml. Interactive if run with no flags.

--projectstring

Project name

--envstring

Environment name

envi init --project acme-api --env production

`envi project create <name>`

envi project create acme-api

`envi env create <name>`

Creates an environment under the current directory's project (from envi.toml).

--projectstring

Project name, if not using the current directory's envi.toml

--productionboolean

Mark this environment as production

envi env create staging
envi env create production --production

Working with secrets

These three all operate on the environment linked by envi init in the current directory.

`envi pull`

Writes the environment's current secrets to .env, at 0600 permissions.

envi pull

`envi push`

Sends local .env changes up. Fails with a conflict if the remote has changed since your last pull or push.

envi push

`envi diff`

Compares local .env against remote without changing either side. Prints added, removed, and changed keys.

envi diff

Collaboration

`envi share <email>`

Invites a collaborator. They receive an email with a link — see Invitations for what happens next, including for people who don't have an account yet.

--projectstring

Project name

--envstring

Environment name

--permissionstringdefault: read

read, write, or manage

envi share teammate@company.com --permission write

`envi invite accept <token>`

Accepts an invitation using the token from an invitation link. You must already be signed in as the invited address — normally you'd just click the link instead, which handles this for you.

envi invite accept <token>

CI/CD

`envi token create --name <name>`

Mints a scoped service token for the current directory's environment.

--namestringrequired

Token name

--permissionstringdefault: read

read, write, or manage

--ttlintdefault: 0

Lifetime in seconds. 0 means no expiry.

envi token create --name github-actions --permission read --ttl 2592000

Everything else

`envi activity`

Recent reads and writes across your organization.

--limitintdefault: 20

Number of recent events to show

envi activity --limit 50

`envi version`

Prints the installed version.

`envi help`

Shows the command list.

Exit codes

Scripts checking envi's exit status can distinguish failure kinds without parsing output:

| Code | Meaning | |---|---| | 0 | Success | | 2 | Usage error — bad flags or arguments | | 3 | Not authenticated | | 4 | Forbidden — authenticated, but not permitted | | 5 | Configuration error — e.g. not initialized, run envi init | | 6 | API error |