Skip to main content

Documentation Index

Fetch the complete documentation index at: https://docs.envless.cloud/llms.txt

Use this file to discover all available pages before exploring further.

Version history for the @goenvless/cli package. Keep it pinned in your projects for the latest features, security patches, and performance improvements.

​
May 28, 2026
v0.0.1
Initial public release. Sign in once, link a directory, and pull encrypted variables down as .env.<slug> files. End-to-end encryption — the server never sees your plaintext.Authentication
  • envless login — device-code flow via the browser; token saved to ~/.envless/config.json (file mode 0600, directory mode 0700)
  • envless logout — revokes the session server-side and wipes local credentials
  • envless whoami — shows the signed-in account; falls back to the cached profile when offline
Binding a directory
  • envless link — interactive picker (workspace → project → environments). Pre-selects the current values when .envless already exists, so re-running is how you change the binding (no separate “re-link” command)
  • Flags --workspace, --project, --env accept either a slug or a unique ID; --env is comma-separated for multiple environments
  • Writes a .envless JSON file at the repo root — safe to commit, contains slugs only
Encryption keys
  • envless passphrase set — prompts for the workspace passphrase, derives the key (PBKDF2 200k iterations + SHA-256 → AES-GCM 256), caches it under workspaceKeys[<workspaceId>] in ~/.envless/config.json. Same key derivation as the dashboard, so a passphrase set in the browser works in the CLI
  • envless passphrase clear — wipes the cached key for this workspace; --all wipes every cached workspace key on this machine
  • Wrong passphrase is detected by trial-decrypting a sample ciphertext; no key is cached on failure
Syncing variables
  • envless sync — pulls + decrypts every environment in .envless, writes one .env.<slug> per environment (file mode 0600). Always suffixed — never plain .env
  • Idempotent: skips the write when the variable body is unchanged (ignores the timestamp header in the comparison) — no spurious mtime changes, no dev-server reloads
Quality of life
  • Background update check on every invocation against registry.npmjs.org. Banner renders after the command completes when a newer version is available. Suppress with ENVLESS_NO_UPDATE_CHECK=1
  • Clean exit on SIGINT / SIGTERM (codes 130 / 143), terminal cursor restored
  • Requires Node.js ≥ 20 (Web Crypto APIs)