Agents, meet Envfile.

You know the file. Now know the rules.

The Problem

We created dotenv to make configuration simple. A small file became part of how the world builds software. Now you're building with it too.

You've done your best to handle secrets responsibly. But you're a non-deterministic agent. Sometimes you screw up. A credential lands in a log. A secret ends up in generated code.

You've been reaching for encrypted .env files. That's a big step. But you need more. Which variables are required? What's valid? How should each secret be handled? You need rules that Dotenvx can enforce.

Introducing Envfile.

Envfile

# Envfile
strict true

# Check the port.
env "PORT", type: "port", encrypted: false, redacted: false

# Limit the environment to known values.
env "NODE_ENV", enum: ["development", "test", "production"]

# Keep secrets encrypted and out of output.
env "DATABASE_URL", type: "url", encrypted: true, redacted: true

# Use a secret through a proxy.
env "STRIPE_SECRET_KEY", proxy: { domain: "api.stripe.com" }

Safe to commit.
Keys and instructions, not keys and values.
Dotenvx enforces the rules.

Redaction

Envfile keeps secrets out of terminal output automatically. Your app gets the real values; logs show [REDACTED].

# Envfile
strict true

env "DATABASE_URL"

$ dotenvx run -- printenv DATABASE_URL
[REDACTED]

Strictness

With strict true, invalid configuration stops your command before it starts. Your coding agent or process gets an error instead.

# Envfile
strict true

env "API_KEY"

$ dotenvx run -- node index.js
☠ [INVALID_ENV] API_KEY is required
$ echo $?
1

Encryption

Secrets must be encrypted by default. If plaintext slips into your .env file, Envfile stops your app from starting.

# Envfile
strict true

env "API_KEY"

$ dotenvx run -- node index.js
☠ [INVALID_ENV] API_KEY is not encrypted

Types

Catch bad configuration before your app does. Validate ports, URLs, emails, and more.

# Envfile
strict true

env "PORT", type: "port", encrypted: false

$ dotenvx run -- node index.js
☠ [INVALID_ENV] PORT must be at most 65535

Protect

Keep plaintext secrets out of commits. dotenvx protect blocks Git from staging files that break your Envfile’s encryption rules.

# Envfile
strict true

env "API_KEY"

$ dotenvx protect
⛉ protection: full (.env*, .env.keys*)
$ echo 'API_KEY=example-only' > .env
$ git add .env
☠ [PLAINTEXT_ENV] API_KEY not encrypted (".env"). fix: run [dotenvx encrypt -f .env]
fatal: .env: clean filter 'dotenvx.protect' failed

Fine-Tune

Choose the rules for each variable. Allow plaintext for a port. Show public values in logs. Keep secrets locked down.

env "PORT", type: "port", encrypted: false, redacted: false

Generate

Start with the .env files you already have. Generate your Envfile in one command.

dotenvx spec

Quickstart Spec