Web Dashboard

The dashboard talks to the same API the CLI does — nothing you do here is a special code path, and nothing here is out of sync with what envi pull would show you.

Sign in at your Envi instance's web address with the same passwordless flow as the CLI: a one-time email code, no password to manage.

Overview

A workspace-level summary: how many projects you have, how many secrets are in the currently selected one, and quick actions for the things you'll do most — new project, add a secret, import a .env file, invite a collaborator.

Choosing a project and environment

A bar across the top of every page picks the project you're working in and, beside it, which of its environments you're looking at. Everything below — secrets, activity, the revision badge — follows that pair.

Production environments carry a PRODUCTION badge next to the picker, so you know before you edit anything that you're in the one that matters.

New environment adds another to the current project. Name it whatever you like; the production checkbox is the same explicit marking the CLI's --production flag sets, with the same consequence — org members stop getting access automatically and each person needs a grant of their own. A project's last environment can't be deleted.

Secrets

The full key/value table for the selected environment. Values are masked by default; reveal one at a time, or copy a value directly without ever displaying it on screen. Revealing is per environment — switch to another and everything is masked again, so a value never stays on screen because of something you opened somewhere else.

Each row carries four actions: reveal, copy, edit, and delete. Copy puts that one value on the clipboard with no KEY= in front of it, ready for a field that wants only the value, and it works whether or not the row is revealed — envi copy <key> is the same thing from the terminal. Edit opens the value in a dialog with the key shown but locked, because changing a key is not an edit — it would leave the old secret in place and add a second one under the new name. To rename a key, add the new one and delete the old.

Saving an edit writes a new version rather than overwriting: the previous value stays in the history, and the revision badge advances the same way envi push would.

Copy all

Copy all puts the whole environment on your clipboard as .env text — the same KEY=VALUE lines envi pull writes, keys sorted, values quoted where they need to be. Vercel, Netlify, Render, Railway and Fly all accept that format pasted into their environment-variable screens in one go, so moving a set of secrets to a platform Envi doesn't run inside is one click and one paste instead of a row at a time.

It copies every secret in the environment, not only the rows matching the key filter.

For a platform where your own process starts the app, prefer envi run or the Docker setup: nothing is copied, nothing is pasted, and rotating a secret doesn't mean visiting a second dashboard.

The revision badge (REV n) in the toolbar matches what envi diff and envi push reason about — if you and a teammate are both looking at the same environment, you're looking at the same number.

Projects

A grid of every project you have access to. Selecting one here changes which project's secrets and activity you're viewing everywhere else in the dashboard. Each card also carries a delete button, which removes the project along with all of its environments and their secrets.

Sharing

Invite a collaborator to the selected project by email, choosing read, write, or manage. See Invitations for what the recipient experiences, including if they don't have an account yet.

Activity

A live feed of reads, writes, and deletes across your organization — the same data envi activity prints, in the dashboard. Each entry shows who (or which service token) touched what, and when.

Settings

Your account email, a sign-out button for the current device, and light/dark theme — the theme choice is stored per-device, not per-account.

API keys

Create, list and revoke personal API keys here. A key signs you in without a browser: on a server, in a script, or against the API directly.

Creating one asks for a name, a permission (read, write or manage) and an expiry. The key is shown once, immediately after creation, because only a hash of it is stored — copy it then or create another.

The list shows what each key may do, when it expires and when it was last used, so a key nobody uses is easy to spot. Revoking one takes effect immediately, and also signs out any session that key created — a leaked key stops being useful the moment you revoke it, not whenever its session happens to run out.