Envshed

For dev teams of 2 to 50 that outgrew shared .env files

Secrets your team can actually trust.

One encrypted place for every project and environment. Per-user overrides for local work, a CLI that feels like git, and AI agents that use secrets without seeing them. $5 per user, flat.

Start free Read the quickstart

No card required. Free for 2 people and 3 projects. 14-day trial on paid plans.

AES-256-GCM at rest
Audit log with hash chaining
Updated 6 months ago
Security ›

~/marble-api

$ npx envshed@latest login
Open this URL in your browser: https://app.envshed.com/device
✓ Logged in successfully.

$ npx envshed@latest init
? Select an organization: marbleox
? Select a project: marble-api
? Select a default environment: development
✓ Created .envshed.json

$ npx envshed@latest run -- npm run dev
  marbleox / marble-api / development
✓ Loaded 12 secrets

Lines from the CLI's own messages. envshed run injects values into the process; nothing is written to disk.

For the whole team

Invite a teammate and they pull the right secrets the same day.

Safe for AI agents

Agents see key names and ask for what is missing. Values stay out of the chat.

The CLI you expect

What it fixes

The stuff that costs a team hours every week

See all features ›

Secrets pasted in Slack

API keys sit in chat history anyone can search.

Values live in one encrypted vault with roles per org, project and environment.

A new hire waits days

Someone has to find and send every .env file.

Invite them to the org; envshed pull gets them the right values.

"Works on my machine"

Every laptop has a slightly different .env.

Per-user overrides change a value for you only. The shared one stays put.

Nobody knows who changed it

Production broke after an edit. Who, and when?

An audit log with user and time, version history and rollback.

The same URL in five files

Copies drift apart, one of them is wrong.

Link a value or reference it, so it is defined once.

Keys expire at 3 AM

A third-party key runs out and nobody was warned.

Set an expiry date and get warned before and after it.

Built for teams

See where every key lives, and where it is missing.

Organizations hold projects, projects hold environments. Compare a key across environments, fill a gap from another one, and keep your own local value without touching the shared one.

Roles: owner, admin, member in the org; admin, editor, viewer per project
Per-user overrides and placeholders for personal keys
One .envshed.json at the repo root maps every workspace
Version history, snapshots and rollback per environment

marble-apiAcross environments Dev Staging Prod

Key	Development	Staging	Production
DATABASE_URL	••••••••••••Override	••••••••••••	••••••••••••
REDIS_URL	••••••••••••	••••••••••••Linked	••••••••••••Linked
STRIPE_SECRET_KEY	Placeholder	••••••••••••	••••••••••••
SENTRY_DSN	••••••••••••	••••••••••••	Fill value
OPENAI_API_KEY	••••••••••••	Fill value	••••••••••••

DATABASE_URL
••••••••••••Override••••••••••••••••••••••••
REDIS_URL
••••••••••••••••••••••••Linked••••••••••••Linked
STRIPE_SECRET_KEY
Placeholder••••••••••••••••••••••••
SENTRY_DSN
••••••••••••••••••••••••Fill value
OPENAI_API_KEY
••••••••••••Fill value••••••••••••

Illustration of the dashboard. Values are always masked; a missing value shows Fill value, as in the app.

Claude Code · envshed MCP

// list_secret_keys · marble-api · production
{ "key": "DATABASE_URL", "status": "set" }
{ "key": "STRIPE_SECRET_KEY", "status": "set" }
{ "key": "OPENAI_API_KEY", "status": "placeholder" }
{ "key": "SENTRY_DSN", "status": "missing" }
// request_secret · SENTRY_DSN
{ "status": "pending", "url": "https://app.envshed.com/..." }

~/marble-api

$ envshed request SENTRY_DSN --reason "errors in staging"
✓ Requested SENTRY_DSN.
Waiting for SENTRY_DSN...
✓ SENTRY_DSN is ready. The value was not printed.

Tool names and CLI lines are the real ones (docs: MCP Server, envshed request).

For AI agents

Agents use secrets without seeing them.

Coding agents need your keys to run tests and deploy. Envshed gives them the result of using a secret, never the value, and a way to ask a person when one is missing.

envshed run

Injects values into the process the agent starts. The model sees the output, not the secrets.

MCP server

Key names and states only: no tool returns a value, no tool accepts one. Works on every plan.

Secret requests

When a key is missing, the agent asks. A person enters the value in the dashboard.

Agent sessions

Short-lived, read-only, one environment, chosen keys. Every read is logged under the agent; revoke any time.

envshed scan

Finds vault values in local agent histories, marks them exposed, and never prints them.

Connect an agent

claude mcp add --transport http envshed https://app.envshed.com/api/mcp

MCP server docs ›

Get started

Three commands to your first secret

Full quickstart in the docs ›

Sign in
terminal
```
$ npx envshed@latest login
✓ Logged in successfully.
```
Opens the browser to approve this device. Signing in the first time creates your account.
Link this folder
terminal
```
$ npx envshed@latest init
✓ Created .envshed.json
```
Pick or create the organization, project and environment. Writes .envshed.json; in a monorepo it maps each workspace.
Run with your secrets
terminal
```
$ npx envshed@latest run -- npm run dev
✓ Loaded 12 secrets
```
Values go into the process, not onto disk. Need a file for another tool? pull writes a .env. Keep the CLI with npm install -g envshed.

Works with your stack

Five integrations shipped, eight more planned on the roadmap, plus one up for community vote. See where your stack lands.

GitHub Actions

Docker

Node.js SDK

CLI (any shell)

Coolify

Vercel

GitLab CI

Python SDK

Netlify

CircleCI

Terraform provider

AWS Secrets Manager

Kubernetes (ESO)

Bitbucket Pipelines

Vote on GitHub

Pricing

$5 per user. No sales call.

Start free. Upgrade when you pass 2 people or 3 projects. Paid plans start with a 14-day trial.

Developer

$0forever

For one or two people. Everything you need to stop pasting secrets into chat.

Start free

Up to 2 members
Up to 3 projects
Unlimited secrets and environments
CLI, API, MCP server
Service tokens, webhooks, audit log

Team

Most teams

$5per user / month

For teams of 3 and more that ship to production.

Start 14-day trial

Unlimited members
Unlimited projects
Everything in Developer
14-day free trial

Business

$9per user / month

For orgs that need SSO and a name for their vendor review.

Start 14-day trial

Everything in Team
SAML SSO (Okta, Entra ID, Google Workspace)
Priority support

Straight answers

What your security reviewer will ask

Security at Envshed ›

Who at Envshed can see my secrets?

Envshed is not a zero-knowledge vault. Values are encrypted at rest with AES-256-GCM; the key lives in production infrastructure, not on laptops. Need client-side encryption? Email us before you sign up.

What if Envshed is down?

A .env you already pulled keeps working. New pulls and runs need the API until we are back.

Can I leave?

envshed pull --format env writes a plain .env you own. No export fee, no ticket.

SOC 2?

Not certified yet; SOC 2 Type II is on the roadmap. The security page lists the controls in place today.

Secrets your team can actually trust.

For the whole team

Safe for AI agents

The CLI you expect

The stuff that costs a team hours every week

Secrets pasted in Slack

A new hire waits days

"Works on my machine"

Nobody knows who changed it

The same URL in five files

Keys expire at 3 AM

See where every key lives, and where it is missing.

Agents use secrets without seeing them.

envshed run

MCP server

Secret requests

Agent sessions

envshed scan

Three commands to your first secret

Sign in

Link this folder

Run with your secrets

By the numbers

Works with your stack

$5 per user. No sales call.

Developer

Team

Business

What your security reviewer will ask

Who at Envshed can see my secrets?

What if Envshed is down?

Can I leave?

SOC 2?