# Node.js

## Install

In your Node.js project, install Dotenvx.

**npm**

```console
$ npm install @dotenvx/dotenvx
```

**pnpm**

```console
$ pnpm add @dotenvx/dotenvx
```

## Encrypt

Start with a secret value in the .env file at your project root, like:

```dotenv
# .env
HELLO="Secret"
```

Encrypt it with a single command.

**npm**

```console
$ npx dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉
```

**pnpm**

```console
$ pnpm exec dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉
```

The values become ciphertext and only your private key can unlock them.

```dotenv
# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"

HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="
```

## Commit

Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git. Keep .env.keys out of git. The -f flag adds the encrypted file even if your project ignores .env files.

```console
$ git add -f .env
$ git commit -m "encrypt .env"
```

## Ship

Load your secrets and read them through process.env. Create index.js:

```javascript
// index.js
require('@dotenvx/dotenvx').config()

console.log(`Hello ${process.env.HELLO}`)
```

Run your app:

```console
$ node index.js
⟐ injected env (2) from .env (022 0D8) via .env.keys
Hello Secret
```

Dotenvx loads and decrypts .env before your code reads process.env.

## Share

Have teammates? Share access with Dotenvx Armor ⛨

Log in to Dotenvx.

**npm**

```console
$ npx dotenvx login
◉ logged in (username)
```

**pnpm**

```console
$ pnpm exec dotenvx login
◉ logged in (username)
```

Create the Armored Key ⛨

**npm**

```console
$ npx dotenvx armor up
⛨ armored .env (022 0D8)
```

**pnpm**

```console
$ pnpm exec dotenvx armor up
⛨ armored .env (022 0D8)
```

Invite your teammate.

**npm**

```console
$ npx dotenvx armor invite
⛨ invited person@example.com to team
```

**pnpm**

```console
$ pnpm exec dotenvx armor invite
⛨ invited person@example.com to team
```

Your teammate accepts the invitation, pulls the repository, installs dependencies, and logs in with dotenvx login. They can then run the app:

```console
$ node index.js
⟐ injected env (2) from .env (022 0D8) via Armor ⛨
Hello Secret
```

[**Not using Armor?** Alternative →](https://dotenvx.com/docs/nodejs/share-private-key.md)

## Production

Create a .env.production file.

```dotenv
# .env.production
HELLO="Production"
```

Encrypt it with an Enclaved Key ◊

**npm**

```console
$ npx dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊
```

**pnpm**

```console
$ pnpm exec dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊
```

When prompted, choose **Enclaved**, select your deployment service, connection, and resource, and use DOTENV_PRIVATE_KEY_PRODUCTION as the private key name.

Commit .env.production.

```console
$ git add -f .env.production
$ git commit -m "encrypt .env.production"
```

Deploy your code and encrypted .env.production file to the selected resource. Install your dependencies there:

**npm**

```console
$ npm install
```

**pnpm**

```console
$ pnpm install
```

Set DOTENV_FILE to .env.production in your deployment environment so Dotenvx knows which file to load. Keep .env.keys on your local machine.

Run your app:

```console
$ node index.js
⟐ injected env (2) from .env.production (022 0D8) via Armor Enclave ◊
Hello Production
```

Dotenvx loads and decrypts .env.production with your Enclaved Key ◊

[**Not using Armor Enclaves?** Alternative →](https://dotenvx.com/docs/nodejs/deploy-private-key.md)

## Conclusion

You've encrypted your secrets, shared access with Armor, and loaded production secrets with Armor Enclaves.