Features
Everything KeyEnv does is a command you can type.
Script it, hand it to CI, or give it to your AI agent. The web app is there when you want it.
keyenv run -e staging
Override only what changes.
Development inherits from staging, which inherits from production. Set a value once at the top and override it only where it differs. Pick an environment to see what a process there would get.
set in this environmentinherited from a parent
3 set here · 3 inherited
DATABASE_URLpostgres://localhost:5432/app_devset here
REDIS_URLredis://localhost:6379set here
STRIPE_SECRET_KEYsk_test_51Mz••••••••Lk2Pfrom staging
LOG_LEVELdebugfrom staging
FEATURE_NEW_BILLINGtrueset here
$ keyenv run -e development -- npm start
keyenv history STRIPE_SECRET_KEY
Every read leaves a line.
People, CI jobs, SDKs, and AI agents all go through the same door, and all of them get written down. Example activity below.
TimeActorActionSecretEnvVia
--:--:--api-workerreadREDIS_URLproductionnode-sdk
--:--:--rotation-botrotatePOSTGRES_PASSWORDproductionscheduler
--:--:--st_ci_deployreadSTRIPE_SECRET_KEYproductiongithub-actions
The rest of the toolbox.
- Encryption at rest
- Every value is encrypted with AES-256-GCM before it is stored, and bound to its row so ciphertext cannot be swapped between secrets. TLS in transit.
- Read more about encryption at rest
- Run without a .env file
keyenv run -- npm startdecrypts into the child process environment. Nothing is written to disk.- Read more about run without a .env file
- Access per environment
- Admin, write, read, or none, set for each person and each environment. Offboarding is one click.
- Read more about access per environment
- Service tokens
- Scoped
st_tokens for CI/CD. Rotate them atomically, with a grace period so a running pipeline keeps working. - Read more about service tokens
- Database credential rotation
- PostgreSQL and MySQL passwords rotate on a schedule. The old credential stays valid while the new one rolls out. Works direct or through an AWS Lambda proxy for private subnets.
- Read more about database credential rotation
- Secret scanning
keyenv scanfinds hardcoded API keys, tokens, and passwords with 149+ provider patterns. Run it locally or on every push.- Read more about secret scanning
- SDKs and CI
- SDKs for Node.js, Python, Go, Rust, Java, PHP, Ruby, and .NET. A GitHub Action, plus guides for GitLab, CircleCI, Kubernetes, Docker, and more.
- Read more about sdks and ci
- AI agents
- Agent Skills teach Claude Code, Codex, Cursor, and 35+ tools to pull secrets and run scans.
npx skills add keyenv/keyenv-skills - Read more about ai agents