Use Bitwarden secrets in .env files

Use Bitwarden secret references in .env files and resolve them securely at runtime.

Dotenvx resolves bw:// references before injecting them into your command.

Prerequisites

To get the most out of this guide, you'll need to:

Get the Dotenvx CLI.

$ curl -sfS https://dotenvx.sh | sh
◈ installed (dotenvx)

more install options

Reference a login item from your Bitwarden vault. Item names can contain spaces.

$ echo 'PASSWORD="bw://My GitHub Account/password"' > .env

The reference format is bw://<item>/<field>. Use an item name or ID with the username, password, or uri field.

Run your command with the secret resolved from Bitwarden. If the vault is locked, Bitwarden prompts you to unlock it.

$ dotenvx run -- sh -c 'echo Password loaded: ${PASSWORD:+yes}'
Password loaded: yes