Rust

Prerequisites

Install Rust and Cargo. Start with a Rust app, or create one:

$ cargo new hello-rust
$ cd hello-rust

Install

Add the Rust SDK:

$ cargo add dotenvx-primitives

Install the Dotenvx CLI to encrypt files and manage keys:

$ curl -sfS https://dotenvx.sh | sh

The compiled app decrypts through the Rust crate; it does not need the CLI. The crate currently resolves keys from an explicit keyring, key files, and process environment variables. Provider callbacks are not supported yet.

Encrypt

Start with a demonstration value in .env at your project root:

# .env
HELLO="Secret"

Encrypt it:

$ dotenvx encrypt

When prompted, choose Local and store the key in .env.keys. The Rust SDK will read that file.

The value becomes ciphertext:

# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"

HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="

Commit

Commit your encrypted .env file with your code. Keep .env.keys out of git.

$ git add .env
$ git commit -m "encrypt .env"

Ship

Read and decrypt the file in your app:

// src/main.rs
use dotenvx_primitives::{parse, ParseOptions};
use std::{error::Error, fs, path::PathBuf};

fn main() -> Result<(), Box<dyn Error>> {
    let path = PathBuf::from(
        std::env::args().nth(1).unwrap_or_else(|| ".env".into()),
    );
    let source = fs::read_to_string(&path)?;
    let result = parse(
        &source,
        &ParseOptions {
            key_files: vec![path.with_file_name(".env.keys")],
            ..Default::default()
        },
    );

    if let Some(error) = result.errors.into_iter().next() {
        return Err(error.into());
    }

    let hello = result.parsed.get("HELLO").ok_or("HELLO is required")?;
    println!("Hello {hello}");
    Ok(())
}

Run it:

$ cargo run
Hello Secret

The SDK returns decrypted values in a map; it does not modify the process environment. This example stops on decryption errors and passes values directly to your code. Existing process values take precedence by default.

HELLO is a demonstration value. Use real secrets in your application without printing them; parse does not automatically redact output.

Use the CLI Alternative →

Share

Give your teammate the encrypted file through git and the private key through your team's approved private channel.

Retrieve the key:

$ dotenvx keypair

Share only the DOTENV_PRIVATE_KEY value. Your teammate puts it in .env.keys at the project root:

# .env.keys
DOTENV_PRIVATE_KEY="your-shared-private-key"

They can then run:

$ cargo run
Hello Secret

Keep .env.keys out of git. Anyone retaining a copy of the key can decrypt the file; removing repository access does not revoke that copy.

Production

Create a separate production file:

# .env.production
HELLO="Production"

Encrypt it. Choose Local and store the key in .env.keys:

$ dotenvx encrypt -f .env.production

Retrieve its private key:

$ dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production

Set DOTENV_PRIVATE_KEY_PRODUCTION to that value in your deployment environment's secret settings. Keep .env.keys on your local machine.

Commit the encrypted file:

$ git add -f .env.production
$ git commit -m "encrypt .env.production"

Build for your deployment platform:

$ cargo build --release

Deploy target/release/hello-rust and .env.production together. Use your package's binary name if different, and hello-rust.exe on Windows. The build does not need the private key.

From that directory, run:

$ ./hello-rust .env.production
Hello Production

The SDK reads the injected key and decrypts .env.production at runtime. No CLI or .env.keys file is needed on the server.

Multiple environment files Alternative →

Conclusion

You've encrypted your configuration, shared a local key, and decrypted production values with the Rust SDK. Encrypted files travel with your code; private keys stay out of git.