Documentation
Advanced
Become a power user of dotenvx.
CLI 📟
Advanced CLI commands.
- run - Variable Expansion
- run - Default Values
- run - Alternate Values
- run - Interpolation Syntax Summary (Variable Expansion, Default/Alternate Values)
- run - Command Substitution
- run - Shell Expansion
- run - Multiline
- run - Contextual Help
- run -f
- run -f directory
- run --env HELLO=String
- run --redact
- run --redact -- claude -p
- run --redact -- claude
- run --redact -- codex exec
- run --redact -- codex
- run --mask
- run --overload
- run - Environment Variable Precedence
- DOTENV_PRIVATE_KEY=key run
- DOTENV_PRIVATE_KEY_PRODUCTION=key run
- DOTENV_PRIVATE_KEY_CI=key run
- DOTENV_PRIVATE_KEY=key DOTENV_PRIVATE_KEY_PRODUCTION=key run - Combine Multiple
- run --verbose
- run --debug
- run --quiet
- run --log-level
- run --validate
- run --strict
- run --convention=nextjs
- run -f directory --convention=nextjs
- DOTENV_CONFIG_CONVENTION=nextjs run
- run --convention=flow
- DOTENV_CONFIG_CONVENTION=flow run
- DOTENV_ENV=production run --convention=flow
- run -fk
- run --no-native
- run --no-armor
- get KEY
- get KEY --mask
- get KEY -f
- get KEY -f directory
- get KEY --env
- get KEY --overload
- get KEY --strict
- get KEY --no-native
- get KEY --no-armor
- get KEY --convention=nextjs
- get KEY -f directory --convention=nextjs
- DOTENV_CONFIG_CONVENTION=nextjs get KEY
- get KEY --convention=flow
- DOTENV_CONFIG_CONVENTION=flow get KEY
- get (json)
- get --format shell
- get --format eval
- get --all
- get --all --pretty-print
- set KEY value
- set KEY value -f
- set KEY "value with spaces"
- set KEY -- "- + * ÷"
- set KEY value --plain
- set KEY_PLAIN value
- set KEY value --no-native
- set KEY value --no-armor
- encrypt
- encrypt -f
- encrypt -fk
- encrypt -k
- encrypt -ek
- encrypt KEY_PLAIN
- encrypt --stdout
- encrypt --no-native
- encrypt --no-armor
- decrypt
- decrypt -f
- decrypt -fk
- decrypt -k
- decrypt -ek
- decrypt --stdout
- decrypt --stdout --mask
- decrypt --no-native
- decrypt --no-armor
- keypair
- keypair -f
- keypair -fk
- keypair DOTENV_PRIVATE_KEY
- keypair --format shell
- keypair --no-native
- keypair --no-armor
Utility Commands 🔌
Advanced CLI utilities.
- ls --json
- gitignore
- gitignore --pattern
- genexample
- genexample -f
- genexample directory
- validate
- precommit
- precommit --install
- precommit directory
- prebuild
- prebuild directory
- lock
- lock up
- lock down
- native
- native up
- native down
- native push
- native pull
- armor
- armor up
- armor down
- armor push
- armor pull
- armor move
- armor login
- armor logout
- armor status
- armor settings
Extensions 🔌
CLI extensions.
Library 📦
Use dotenvx directly in code.
- config()
- config(path: ['.env.local', '.env'])
- config(overload: true)
- config(mask: true)
- config(quiet: true)
- config(strict: true)
- config(ignore: ['.env.missing', '.env'])
- config(envKeysFile: '../../.env.keys')
- config(convention: 'nextjs')
- config(path: directory, convention: 'nextjs')
- DOTENV_CONFIG_CONVENTION=nextjs config()
- DOTENV_CONFIG_CONVENTION=flow config()
- parse(src)
- parse(src, {processEnv:})
- parse(src, {privateKey:})
- set(KEY, value)
- set(KEY, value, {plain: true})
- get(KEY)
- get(KEY, {mask: true})
Whitepaper 📄
Dotenvx: Reducing Secrets Risk with Cryptographic Separation
Abstract. An ideal secrets solution would not only centralize secrets but also contain the fallout of a breach. While secrets managers offer centralized storage and distribution, their design creates a large blast radius, risking exposure of thousands or even millions of secrets. We propose a solution that reduces the blast radius by splitting secrets management into two distinct components: an encrypted secrets file and a separate decryption key.
...