Run
Inject env at runtime. Use --redact for runtime leak protection and log redaction.
Usage
Given you have an app with environment variables:
console.log(`Hello ${process.env.HELLO}`)Encrypt your .env file. Your secrets stay safely encrypted at rest.
$ dotenvx encrypt
◈ encrypted (.env)And then decrypt and inject them at runtime - just in time.
$ dotenvx run -- node index.js
⟐ injected env (14) from .envThis works cross-platform across plaintext and encrypted .env files.
Options
- run - Variable Expansion
- run - Default Values
- run - Alternate Values
- run - Interpolation Syntax Summary (Variable Expansion, Default/Alternate Values)
- run - Command Substitution
- run - Shell Expansion
- run - Multiline
- run - Contextual Help
- run -f
- run -f directory
- run -fk
- run --env HELLO=String
- run --redact — runtime leak protection & log redaction
- run --redact -- claude -p — log redaction
- run --redact -- claude — runtime leak protection
- run --redact -- codex exec — log redaction
- run --redact -- codex — runtime leak protection
- run --mask
- run --token
- run --overload
- run --ignore
- run - Environment Variable Precedence
- DOTENV_PRIVATE_KEY=key run
- DOTENV_PRIVATE_KEY_PRODUCTION=key run
- DOTENV_PRIVATE_KEY_CI=key run
- DOTENV_PRIVATE_KEY=key DOTENV_PRIVATE_KEY_PRODUCTION=key run - Combine Multiple
- run --verbose
- run --debug
- run --quiet
- run --log-level
- run --validate
- run --strict
- run --convention=nextjs
- run -f directory --convention=nextjs
- run --convention=flow
- DOTENV_ENV=production run --convention=flow
- run --no-native
- run --no-armor