Env secrets, finally handled
Secrets management for developers
Stop treating .env like a team wiki.
Encrypt secrets per environment. Version every change. Pull what you need with the CLI — and keep production keys out of git, Slack, and someone’s Downloads folder.
EANVI encrypts secrets across environments. Pillar blocks assemble into the brand mark, pull in secrets, lock securely at the core, then the sequence loops. Click the center to restart.
checkout-api / production
4 secrets · encrypted at rest
| Key | Env |
|---|---|
| DATABASE_URL | production |
| STRIPE_SECRET_KEY | production |
| NEXTAUTH_SECRET | staging |
| REDIS_URL | development |
What EANVI solves
Engineering teams struggle to share API keys, credentials, and environment configuration across development, staging, and production without leaking secrets into git, Slack, or stale zip files. EANVI is a centralized secrets and environment variable platform with encryption, version history, roles, and CLI sync.
Environment variable management
Named environments per project so local overrides never silently become production values.
Secrets management
AES-256-GCM at rest, masked list views, and audited reveals when someone needs plaintext.
Team collaboration
Organizations, invites, and roles so access is revocable — not forwarded as a file.
CLI & CI/CD workflow
eanvi pull/push/sync for local work; API keys for non-interactive pipelines.
What ships with EANVI
Encrypted secrets, environments, a CLI, secret versioning, and an audit trail — without a second ops stack.
Secret Management
Encrypted storage with version history for every environment variable.
Team Collaboration
Organizations, roles, and invites so secrets stay with the right people.
CLI Sync
Pull and push secrets from the terminal with the Eanvi CLI.
Audit Logs
Full activity tracking for secrets, members, and billing events.
Environment Support
Dev, staging, production, and preview — isolated by design.
Import / Export
Migrate from .env files, JSON, or YAML in a single pass.
Developer guides
Practical pages on secrets, environment variables, .env files, and pipeline credentials — linked from the product, not bolted on as keyword farms.
- Secrets managementEncrypted vault, environments, versions, and team roles.
- Environment variablesManage config across development, staging, and production.
- .env file managementKeep dotenv as a checkout — not the team source of truth.
- CI/CD secretsAPI keys and CLI pull for headless pipelines.
- Production secretsLeast privilege, isolated environments, audited reveals.
- GitHub Actions secretsPull vault values in Actions without committing .env files.
Simple pricing
Start free. Upgrade when you need history, seats, and longer audit retention.
Free
Personal projects and first encrypted workspaces.
- 1 organization
- 2 projects
- 3 environments
- 25 encrypted secrets
- 7-day audit log history
- CLI and API token access
Pro
Professional workflows with history and import/export.
- 1 organization
- Unlimited projects
- Unlimited environments
- 500 encrypted secrets
- 30-day audit log history
- Version history and rollbacks
- Import and export (.env, JSON, YAML)
- Priority support
Team
Collaboration, governance, and seat-based billing.
- Unlimited organizations
- Unlimited projects and environments
- Unlimited encrypted secrets
- Seats count unique members across organizations
- 90-day audit log history
- Centralized invoicing and adjustable seat quotas
- Dedicated support and SLA
Questions, answered
Encrypt secrets per environment. Version every change. Pull what you need with the CLI — and keep production keys out of git, Slack, and someone’s Downloads folder.
How do I stop committing .env files?
Keep secrets in Eanvi instead of in git. From a project folder, run eanvi init to bind the environment, then eanvi pull to write a local .env that stays gitignored. Share access through the org — not by pasting values in Slack or checking files into the repo.
Are my secret values encrypted?
Yes. Values are encrypted at rest with AES-256-GCM before they hit the database. List and browse views show keys only; plaintext appears only when you explicitly reveal or pull a value. Your team never sees ciphertext as the working format — you work with keys and decrypted values on demand.
How do I use this from the CLI and CI?
Authenticate once with eanvi login (or an API key in CI). eanvi pull writes the current environment to a local file; eanvi push uploads local changes with version checks; eanvi sync, diff, list, and doctor cover day-to-day work. Pipelines use API keys so deploys never need an interactive login.
Start on the Free plan
Create a workspace, import a .env, and pull it from the terminal.