A complete platform that replaces scattered .env files with a secure, audited, team-friendly workflow.
Secret values are stored exclusively in HashiCorp Vault's KV-v2 engine. They never touch your metadata database — ever.
Three granular roles — Admin, Developer, and CI — control who can read, write, or manage secrets per project.
Development, staging, and production environments are isolated by default. Pull the right secrets for the right context.
Every secret read, write, and deletion is logged with user identity, timestamp, and metadata. Full compliance visibility.
Initialize projects, push/pull .env files, set individual secrets, and onboard teammates — all from your terminal.
Built-in observability with request counters, latency histograms, and Vault operation tracking out of the box.
Secret values are masked by default in the dashboard. Reveal them on-demand with an automatic 10-second auto-hide timer.
Rotate project Vault tokens with one click or command. All previous tokens are immediately invalidated.
Every secret update increments the version counter via Vault's native versioning. See when each secret was last modified.
Four steps from zero to a fully secured secrets pipeline for your team.
Create a project and receive your Vault token.
envault init my-appPush your .env file or set secrets one by one.
envault env push --env prod -f .envOnboard teammates with scoped roles.
envault onboard dev@co.com --role developerPull secrets into any environment or CI pipeline.
envault env pull --env prodEvery architectural decision in Envault prioritizes security. Secret values are completely isolated from metadata, access is scoped by role, and every action leaves an audit trail.
Every request is validated against your Supabase JWKS endpoint. No session cookies to steal.
PostgreSQL stores metadata only. Vault stores values. A database breach never exposes secrets.
Middleware enforces roles on every request. CI tokens can only read — they can never write or manage.
Who read what, when, from where. Every secret access is recorded with full user context.
A full-featured CLI that fits into any workflow — local dev, CI/CD pipelines, or team onboarding.
envault initCreate project
envault env pullDownload secrets
envault env pushUpload .env file
envault secret setSet a secret
envault secret getRead a secret
envault onboardInvite teammate
envault rotateRotate tokens
envault env listList all keys
envault secret deleteRemove a secret