StoreEnv Beta
Documentation

Install the CLI, learn the model and look up every command.

CLI reference

storeenv push

Encrypt and upload env files as a new version.

Global flags
zsh
$ cd ~/code/my-app
$ storeenv push -m "First version" --yes
  Project    ada/my-app   (no Git)
  Scanning   2 env files  (ignored: node_modules, .git, dist, .next)
 
  SERVICE   FILE              ENV          CHANGES
  root      .env              default      +2
  root      .env.production   production   +2
 
  Encrypting 4 secrets locally and uploading... done
 
  default     v b8c7ece   "First version"
  production  v e5314c9   "First version"
  Keys wrapped for 1 member. Template updated.  View: storeenv open
 
  Next: run storeenv pull on another machine
$ storeenv push

Flags

--message <value>, -mVersion message, like a commit message.
--file <value>Push one file only, for example backend/.env.production.
--service <value>Push all files of one service.
--forcePush on top even if the remote has a newer version.
--dry-runShow the plan and upload nothing.
--skip-unverifiedEncrypt only for readers whose keys are verified; the rest wait for a key share.

More examples

$ cd ~/code/my-app
$ storeenv push -m "Turn the flag on" --yes
  Local commits to upload (1):
    fdab642  Turn the flag on  +1
 
    fdab642  "Turn the flag on"  default v 5a203a5
 
  Project    ada/my-app   (no Git)
  Scanning   2 env files  (ignored: node_modules, .git, dist, .next)
 
  SERVICE   FILE              ENV          CHANGES
  root      .env              default      no changes
  root      .env.production   production   no changes
 
  Your env files match the last commit. Nothing else to push.
 
$ cd ~/code/shared-stripe
$ storeenv push -m "Stripe test keys" --yes
  Project    ada/shared-stripe   (no Git)
  Scanning   1 env file  (ignored: node_modules, .git, dist, .next)
 
  SERVICE   FILE   ENV       CHANGES
  root      .env   default   +2
 
  Encrypting 2 secrets locally and uploading... done
 
  default  v c053ee5   "Stripe test keys"
  Keys wrapped for 1 member. Template updated.  View: storeenv open
 
  Next: run storeenv pull on another machine

Good to know

  • Values are never printed by push.
  • Only secrets whose value changed are encrypted again; the rest are carried forward.
  • If the remote moved since you last synced, push stops with SE_REMOTE_AHEAD: pull first, or --force to add your version on top. History is never lost.
  • The scanner runs first. Lines that aren't KEY=value and quotes that never close stop the push; values that look like live provider keys (AWS, Stripe, Razorpay, OpenAI and others), duplicate keys, and env files tracked by Git or missing from .gitignore are warnings. storeenv scan runs it alone.

Related commands

storeenv pullstoreenv statusstoreenv diffstoreenv commit

Global flags

--project <value>Project as <namespace/name> or its id (default: .storeenv.json, then this repository's remotes).
--env <value>Environment name.
--jsonMachine readable output.
--yes, -ySkip confirmations.
--colorColoured output (--no-color to turn off). Default: true.
--verboseShow debug details.
--api <value>API base URL of a self-hosted StoreEnv.
--trust-writer <value>Trust a writer for this run: @login=SE:XXXX-XXXX-XXXX.
--allow-unsignedpull and diff: use values that aren't signed by a trusted writer, after you confirm on a terminal (or with STOREENV_ALLOW_UNSIGNED=1). Never applies to run or copy.
Previous commit Next pull