Overview
What running your own instance actually involves.
Envi is offered as a hosted product, and this is the same stack behind it — nothing is held back for a separate self-hosted build. Running your own instance means running four things:
The source of truth for everything: projects, environments, encrypted secrets, access grants, audit events.
Short-lived state only — OTP codes and rate-limit counters. Nothing here needs to survive a restart.
A single stateless Go binary (cmd/api), talking to both. This is the entire backend.
A tiny, dependency-free Go binary (cmd/install) serving curl | sh install scripts. No database, no auth.
The web dashboard is optional infrastructure
The Next.js dashboard is a separate deployable — it's a client of the API, exactly like the CLI is, and doesn't need to live on the same machine or even be self-hosted at all. Deploying it to Vercel (or anywhere else that runs Next.js) and pointing ENVI_API_URL at your self-hosted API works fine.
Encryption key ownership
ENVI_ENCRYPTION_KEY decrypts every secret in your database. It lives only in the API process's environment — never in Postgres, never in a request, never logged. Losing it means losing access to every secret ever stored; there is deliberately no recovery path around the encryption key, because a recovery path is also a bypass.
Outbound email
OTP codes and invitations go out through Resend — bring your own API key and a verified sending domain. Without a verified domain, Resend restricts sending to the address your own account is registered with, which is enough to test the flow but not to invite real users.
Next
Deployment walkthroughA concrete, first-deploy guide: system dependencies, the database, process management, and TLS.