sharedenv brings your team's environment variables, API keys and passwords into one place. Everything is end-to-end encrypted: our servers never see a secret in plaintext.
npm i @sharedenv/cliOne day in the life of a Stripe key. Every step leaves a line in the audit log, none shows it to the server in plaintext.
The browser draws a key for the vault and encrypts the value with AES-256-GCM. Your private key stays in memory, never on disk.
The server receives an encrypted blob and the vault key sealed to your public key. It knows who may access it, not what is inside.
The vault key is resealed to Lea's public key (ECDH secp256k1) and signed. Lea opens it with her own private key, and any tampering shows when she does.
The CLI decrypts in memory and injects the variables into the process. Nothing is written to disk.
sharedenv run -v api-prod -- npm startRemoving a member rotates the vault key: secrets are re-encrypted and the new key resealed to the remaining members. Tom's old envelope opens nothing.
Illustrative example: Lea, Tom and the times are fictional.
On the left, everything our servers keep of your vault. On the right, what you see once it is unlocked. Nothing crosses from right to left.
AES-256-GCM encryption, sharing through signed ECDH secp256k1, password derived with scrypt. Standard primitives, nothing home-made.
Everything that should never end up in a chat message or a git repo. One vault per project or environment, the same encryption for all of it.
A key in environment variable format, a free-form value. The associated URL and username are encrypted too.
Your dev, staging or prod .env, pulled or injected by the CLI.
The team's shared logins, filled into the page by the Chrome extension.
Stripe, AWS, OpenAI: one key per line, readable only by the vault's members.
A private key or a PEM certificate fits in one value, encrypted like the rest.
The CLI runs the same crypto as the browser. Your password and private key never leave the process, only a session cookie touches the disk.
sharedenv loginOpens a session. The password stays in the process.
sharedenv run -v api-prod -- npm startRuns your command with the vault's secrets in its environment, decrypted in memory.
sharedenv pull -v api-prod --out .envPrints the secrets as dotenv, to the console or to a file in 0600 mode.
sharedenv fingerprintShows your public key fingerprint, to read to a teammate before sharing.
Three levels per vault, plus the owner. The server enforces access without ever needing to read a secret.
| Level | Read and copy | Add, edit, delete | Members and rotation | Audit log | Delete the vault |
|---|---|---|---|---|---|
| ReaderFor a teammate's CLI | |||||
| WriterFor whoever changes the config | |||||
| AdminFor whoever manages access | |||||
| OwnerWhoever created the vault |
Invite by email, a lead provisions the team key, then share a vault with the whole team at once.
An authenticator app or an email code, with backup codes.
A one-time code shown when your vault is created. It is what gives you access back after a forgotten password.
Free to start, no credit card. Then you pay per person.
For personal use and trying things out.
For developers and small teams.
For organizations that share at scale.
Prices include VAT. Cancel anytime from your billing area. By subscribing, you accept the terms of sale.