Quickstart

1. Encrypt

Start with a value in your .env file, like:

# .env
HELLO="Secret"

Encrypt it with a single command.

$ dotenvx encrypt
◈ encrypted (.env)

Your encrypted secrets stay in .env and your private key is put in .env.keys.

2. Commit

Edit your .gitignore to ignore .env.keys and allow .env.

# .gitignore
.env.keys
!.env

Commit your encrypted .env file to code.

$ git add .
$ git commit -m "Add encrypted sample secret"
[main 6c79581] Add encrypted sample secret

Your .env.keys file stays on your machine for now.

3. Run

Use your secret in an app. Ours is a simple hello world Node.js app—create an index.js file:

// index.js
console.log(`Hello ${process.env.HELLO}`)

Run it with dotenvx:

$ dotenvx run -- node index.js
⟐ injected env (2) from .env
Hello Secret

Your secret is encrypted in Git, and your app can still read it. The .env file stays encrypted on disk.

To ship to production, deploy the encrypted .env and set DOTENV_PRIVATE_KEY in your hosting platform's secret settings. Keep .env.keys out of the deployment. Find your platform's guide →