Skip to content
NS360

W-03 · Developer platform · Dashboard, REST API, SDKs & CLI

EnvVaultSecrets and configuration, from the edge to the running process.

One system of record for environment variables and secrets, reachable from a dashboard, an API, SDKs and a cross-platform CLI.
envvault.com
The EnvVault website: “Modern environment management for modern development teams”, with Get started and Book demo buttons.

01The problem

Secrets leak through the gaps between tools: a pasted `.env`, a CI variable nobody rotates. One API has to serve every surface without widening those gaps.

EnvVault gives software teams one system of record for the configuration their applications depend on: project-scoped environment variables and organization-wide secrets across development, staging and production.

A web dashboard, a REST API, Node.js and Python SDKs and the envv command-line tool all work through the same API. According to its documentation, organization secrets are encrypted in memory before they are written to storage, and every change creates a new version.

At runtime, the CLI launches local processes and containers with the right values already in their environment, and generates configuration for CI pipelines and serverless platforms.

02What makes it hard

The engineering inside EnvVault.

  1. 01

    Plaintext kept out of storage

    Organization secrets are encrypted and decrypted in memory at the edge, and only ciphertext is stored.

  2. 02

    One contract, several clients

    Bearer-key endpoints for the CLI and SDKs and session-based endpoints with TOTP sign-in for the dashboard, behind a consistent error format and per-IP rate limits.

  3. 03

    Least-privilege keys

    API keys whose effective permissions are the intersection of the creator’s role, a project allowlist, a CIDR allowlist and a required expiry. Keys are shown once and never stored in plaintext.

  4. 04

    Care on developer machines

    The CLI keeps its token in the operating system’s credential store where one exists, encrypts its optional cache with a machine-bound key and passes values to the child process in memory.

  5. 05

    Process behavior you can rely on

    envv run forwards signals, never overrides variables the shell or CI runner already set, and moves to a free port when the requested one is taken.

  6. 06

    An audit trail for investigations

    Typed events for secrets, variables, projects, team changes, API keys, sign-ins and billing, filterable by category, resource, action, date and actor.

03In the product

Terminal

# start a process with the environment’s values already in place

$ envv run -- npm run dev

# the same values for containers

$ envv docker-run -- docker compose up

# generate configuration for serverless platforms

$ envv serverless

Commands from EnvVault’s public documentation

Practices involved

Where this sits in what we do.

Start a conversation

Have a product with a hard problem inside it?

Tell us what it has to do, and what keeps going wrong.

Start a project