Usage
Encrypt
$ dotenvx encrypt
◈ encrypted (.env)Encrypt your secrets in .env files. The values become ciphertext and only your private key can unlock them.
Commit
$ git add .env
$ git commit -m "encrypt .env"Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git.
Ship
$ dotenvx run -- node index.js
⟐ injected env (2) from .envShip your code and secrets together. Dotenvx uses your private key to decrypt and inject your secrets just-in-time to your code.
Design
Three widely used and proven primitives make up Dotenvx's design. Git, .env, and secp256k1.
We chose git because it is the best way to deliver digital goods. It is the container ship of the digital world. All code travels on its ships. Why not secrets? Why invent an inferior secrets delivery mechanism when the world class one is right there at your fingertips.
We chose .env because it is the open standard for loading secrets into code. It represents environment variables, the core primitive that all secrets end up injected into at runtime of code.
Lastly, we needed to choose an encryption algorithm. Encryption of the values inside the .env file would allow us to place those values with code, leveraging git's distribution advantages while still following the twelve-factor config – by separating the decryption key from the code (environment).
It was important that we choose a proven, simple, asymmetric standard with small keys. We chose secp256k1, battle-tested by Bitcoin for more than seventeen years. We made cryptography an opinionated choice so developers wouldn't have to. Encryption just worked.
The result is a system built entirely from primitives, developers already understand, and infrastructure they already use. Secrets can travel with code without becoming part of the code. Git distributes them, .env defines how apps consume them, and secp256k1 keeps their values unreadable. The kicker, all this works by setting a single private key on your infrastructure - no more risky async coordination of secrets, no more centralized downtime risk. Your secrets are always just there with your code, ready to be unlocked at runtime.
One Private Key
Set DOTENV_PRIVATE_KEY where your app runs. That one key unlocks the secrets in its encrypted .env file—so you provision a single key for each environment instead of copying every secret into every deployment.
Your secrets stay encrypted as they travel with your code. When you launch your app with dotenvx run, Dotenvx decrypts them just in time and injects them into the app’s environment. Keep the private key outside Git; the encrypted secrets can go wherever your code goes.
$ dotenvx run -- npm start
⟐ injected env (2) from .env.production
> [email protected] start
> node server.js
App listening on port 3000Once your secrets are in an encrypted git workflow, you'll wonder why you waited so long. It feels so good and unlocks so much.