Install dotenvx using Winget - wingetCollections

dotenvx dotenvx

cli dotenv dotenvx encryption env environment variables

Use this command to install dotenvx:

winget install --id=dotenvx.dotenvx -e

dotenvx is a cross-platform tool designed to simplify environment variable management for developers and DevOps teams. Built by the creator of dotenv, dotenvx enhances security and flexibility with encrypted variables, multi-environment support, and seamless integration across programming languages and frameworks.

Key Features:

Cross-platform compatibility, supporting Windows, macOS, Linux, and other environments.
Multi-environment configuration, allowing users to manage different .env files for development, testing, and production.
Encrypted environment variables, ensuring sensitive data is protected both at rest and in transit.
CLI-based interface enabling direct execution of scripts or commands with injected environment variables.
Support for a wide range of programming languages (Node.js, Python, Go, Rust, Java, etc.) and frameworks (Next.js, Rails, Laravel).

Audience & Benefit: Ideal for developers working on projects that require secure and efficient management of environment variables. dotenvx helps teams streamline workflows, reduce configuration errors, and enhance security by encrypting sensitive data. It is particularly beneficial for organizations deploying applications across multiple environments or using diverse programming languages.

The tool can be installed via winget on Windows, making it easy to integrate into existing development pipelines.

README

a secure dotenv–from the creator of dotenv.

run anywhere (cross-platform)
multi-environment
encrypted envs

Read the whitepaper

Quickstart

Install and use it in code just like dotenv.

npm install @dotenvx/dotenvx --save

// index.js
require('@dotenvx/dotenvx').config()
// or import '@dotenvx/dotenvx/config' // for esm

console.log(`Hello ${process.env.HELLO}`)

or install globally - unlocks dotenv for any language, framework, or platform!

with npm 🌍

npm i -g @dotenvx/dotenvx
dotenvx encrypt

with curl 🌐

curl -sfS https://dotenvx.sh | sh
dotenvx encrypt

with brew 🍺

brew tap dotenvx/brew
brew trust dotenvx/brew
brew install dotenvx
dotenvx encrypt

with docker 🐳

docker run -it --rm -v $(pwd):/app dotenv/dotenvx encrypt

with github releases 🐙

curl -L -o dotenvx.tar.gz "https://github.com/dotenvx/dotenvx/releases/latest/download/dotenvx-$(uname -s)-$(uname -m).tar.gz"
tar -xzf dotenvx.tar.gz
./dotenvx encrypt

Versions

2.19.1

2.19.0

2.18.1

2.18.0

2.17.4

2.17.3

2.17.2

2.17.1

2.17.0

2.16.1

show 190 more

Website

github.com

License

Last updated

7/30/2026

Download latest version

winget install dotenvx
dotenvx encrypt

$ echo "HELLO=World" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ node index.js
Hello undefined # without dotenvx

$ dotenvx run -- node index.js
Hello World # with dotenvx
&gt; :-D

$ curl -fsSL https://claude.ai/install.sh | bash
$ claude --version

$ echo "HELLO=World" &gt; .env

$ dotenvx run --redact -- claude -p 'Run `dotenvx get HELLO` and echo back just Hello VALUE' --dangerously-skip-permissions
Hello [REDACTED]

$ npm install -g @openai/codex
$ codex --version

$ echo "HELLO=World" &gt; .env

$ dotenvx run --redact -- codex exec 'Run `dotenvx get HELLO` and echo back just Hello VALUE' --skip-git-repo-check
Hello [REDACTED]

$ curl https://cursor.com/install -fsS | bash
$ agent --version

$ echo "HELLO=World" &gt; .env

$ dotenvx run --redact -- agent -p --force 'Run `dotenvx get HELLO` and echo back just Hello VALUE' --output-format text
Hello [REDACTED]

$ echo "HELLO=op://Personal/hello/password" &gt; .env
$ dotenvx run -- sh -c 'echo Hello $HELLO'
Hello World

$ echo 'HELLO="bw://My Hello Login/password"' &gt; .env
$ dotenvx run -- sh -c 'echo Hello $HELLO'
Hello World

// package.json
{
  "type": "module",
  "dependencies": {
    "chalk": "^5.3.0"
  }
}

// index.ts
import chalk from 'chalk'
console.log(chalk.blue(`Hello ${process.env.HELLO}`))

$ npm install
$ echo "HELLO=World" &gt; .env

$ dotenvx run -- npx tsx index.ts
Hello World

{
  "scripts": {
    "dev": "dotenvx run -- astro dev",
    "build": "dotenvx run -- astro build",
    "preview": "dotenvx run -- astro preview"
  }
}

export async function GET() {
  return new Response(
    JSON.stringify({
      HELLO: process.env.HELLO,
    }),
    {
      status: 200,
      headers: {
        "Content-Type": "application/json",
      },
    }
  );
}

{
  "scripts": {
    "start": "dotenvx run -- expo start",
    "reset-project": "node ./scripts/reset-project.js",
    "android": "dotenvx run -- expo start --android",
    "ios": "dotenvx run -- expo start --ios",
    "web": "dotenvx run -- expo start --web",
    "lint": "expo lint"
  }
}

$ npm install @dotenvx/dotenvx
$ npm install @dotenvx/next-env

{
  "overrides": {
    "@next/env": "npm:@dotenvx/next-env"
  }
}

$ npx dotenvx encrypt
◈ encrypted (.env)

import { NextResponse } from 'next/server'

export async function GET() {
  return NextResponse.json({
    HELLO: process.env.HELLO
  })
}

$ dotenvx encrypt -f .env.txt

// src/index.js
import envSrc from '../.env.txt'
import dotenvx from '@dotenvx/dotenvx'

const config = dotenvx.config({ envs: [{ type: 'env', value: envSrc, privateKeyName: 'DOTENV_PRIVATE_KEY' }] })
const envx = config.parsed

export default {
  async fetch(request, env, ctx) {
    return new Response(`Hello ${envx.HELLO}`)
  }
}

"scripts": {
  "deploy": "wrangler deploy",
  "dev": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
  "start": "wrangler dev --var $(dotenvx keypair -f .env.txt --format=colon)",
}

$ echo "HELLO=Test" &gt; .env.test
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ bun index.js
Hello undefined

$ dotenvx run -f .env.test -- bun index.js
Hello Test

$ echo "HELLO=World" &gt; .env
$ echo "console.log('Hello ' + Deno.env.get('HELLO'))" &gt; index.ts

$ deno run --allow-env index.ts
Hello undefined

$ dotenvx run -- deno run --allow-env index.ts
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'import os;print("Hello " + os.getenv("HELLO", ""))' &gt; index.py

$ dotenvx run -- python3 index.py
Hello World

$ echo "HELLO=World" &gt; .env
$ echo ' index.php

$ dotenvx run -- php index.php
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'puts "Hello #{ENV["HELLO"]}"' &gt; index.rb

$ dotenvx run -- ruby index.rb
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'package main; import ("fmt"; "os"); func main() { fmt.Printf("Hello %s\n", os.Getenv("HELLO")) }' &gt; main.go

$ dotenvx run -- go run main.go
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'fn main() {let hello = std::env::var("HELLO").unwrap_or("".to_string());println!("Hello {hello}");}' &gt; src/main.rs

$ dotenvx run -- cargo run
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'public class Index { public static void main(String[] args) { System.out.println("Hello " + System.getenv("HELLO")); } }' &gt; index.java

$ dotenvx run -- java index.java
Hello World

$ echo "HELLO=World" &gt; .env
$ echo '(println "Hello" (System/getenv "HELLO"))' &gt; index.clj

$ dotenvx run -- clojure -M index.clj
Hello World

$ echo "HELLO=World" &gt; .env
$ echo 'fun main() { val hello = System.getenv("HELLO") ?: ""; println("Hello $hello") }' &gt; index.kt
$ kotlinc index.kt -include-runtime -d index.jar

$ dotenvx run -- java -jar index.jar
Hello World

$ dotnet new console -n HelloWorld -o HelloWorld
$ cd HelloWorld
$ echo "HELLO=World" | Out-File -FilePath .env -Encoding utf8
$ echo 'Console.WriteLine($"Hello {Environment.GetEnvironmentVariable("HELLO")}");' &gt; Program.cs

$ dotenvx run -- dotnet run
Hello World

$ echo "HELLO=World" &gt; .env

$ dotenvx run --quiet -- sh -c 'echo Hello $HELLO'
Hello World

$ echo "HELLO=World" &gt; .env

$ dotenvx run --quiet -- sh -c 'echo Hello $HELLO'
Hello World

# run every day at 8am
0 8 * * * dotenvx run -- /path/to/myscript.sh

$ dotenvx run -- next dev
$ dotenvx run -- npm start
$ dotenvx run -- bin/rails s
$ dotenvx run -- php artisan serve

$ docker run -it --rm -v $(pwd):/app dotenv/dotenvx run -- node index.js

FROM node:latest
RUN echo "HELLO=World" &gt; .env &amp;&amp; echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js
RUN curl -fsS https://dotenvx.sh/install.sh | sh
CMD ["/usr/local/bin/dotenvx", "run", "--", "echo", "Hello $HELLO"]

name: build
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - uses: actions/setup-node@v3
      with:
        node-version: 16
    - run: curl -fsS https://dotenvx.sh/install.sh | sh
    - run: dotenvx run -- node build.js
      env:
        DOTENV_KEY: ${{ secrets.DOTENV_KEY }}

# heroku
heroku buildpacks:add https://github.com/dotenvx/heroku-buildpack-dotenvx

# docker
RUN curl -fsS https://dotenvx.sh | sh

# vercel
npm install @dotenvx/dotenvx --save

// pm2
"scripts": {
  "start": "dotenvx run -- pm2-runtime start ecosystem.config.js --env production"
},

# alternatively use npx
$ npx @dotenvx/dotenvx run -- node index.js
$ npx @dotenvx/dotenvx run -- next dev
$ npx @dotenvx/dotenvx run -- npm start

$ npm install @dotenvx/dotenvx --save

{
  "scripts": {
    "start": "./node_modules/.bin/dotenvx run -- node index.js"
  },
  "dependencies": {
    "@dotenvx/dotenvx": "^0.5.0"
  }
}

$ npm run start

&gt; start
&gt; ./node_modules/.bin/dotenvx run -- node index.js

[dotenvx@1.X.X] injecting env (1) from .env.production
Hello World

# use dotenvx with asdf
$ asdf plugin add dotenvx
$ asdf install dotenvx latest

# use as a git submodule
$ git dotenvx run -- node index.js
$ git dotenvx run -- next dev
$ git dotenvx run -- npm start

# .env
USERNAME="username"
DATABASE_URL="postgres://${USERNAME}@localhost/my_database"

// index.js
console.log('DATABASE_URL', process.env.DATABASE_URL)

$ dotenvx run --debug -- node index.js
[dotenvx@0.14.1] injecting env (2) from .env
DATABASE_URL postgres://username@localhost/my_database

# .env
DATABASE_URL="postgres://$(whoami)@localhost/my_database"

// index.js
console.log('DATABASE_URL', process.env.DATABASE_URL)

$ dotenvx run --debug -- node index.js
[dotenvx@0.14.1] injecting env (1) from .env
DATABASE_URL postgres://yourusername@localhost/my_database

$ echo "HELLO=production" &gt; .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.production -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.production
Hello production
&gt; ^^

$ echo "HELLO=local" &gt; .env.local

$ echo "HELLO=World" &gt; .env

$ dotenvx run -f .env.local -f .env -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local,.env
Hello local

$ echo "HELLO=local" &gt; .env.local

$ echo "HELLO=World" &gt; .env

$ dotenvx run -f .env.local -f .env --overload -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local,.env
Hello World

$ echo "HELLO=production" &gt; .env.production

$ dotenvx run -f .env.production --verbose -- node index.js
[dotenvx][verbose] injecting env from /path/to/.env.production
[dotenvx][verbose] HELLO set
[dotenvx@1.X.X] injecting env (1) from .env.production
Hello production

$ echo "HELLO=production" &gt; .env.production

$ dotenvx run -f .env.production --debug -- node index.js
[dotenvx][debug] configuring options
[dotenvx][debug] {"envFile":[".env.production"]}
[dotenvx][verbose] injecting env from /path/to/.env.production
[dotenvx][debug] reading env from /path/to/.env.production
[dotenvx][debug] parsing env from /path/to/.env.production
[dotenvx][debug] {"HELLO":"production"}
[dotenvx][debug] writing env from /path/to/.env.production
[dotenvx][verbose] HELLO set
[dotenvx][debug] HELLO set to production
[dotenvx@1.X.X] injecting env (1) from .env.production
Hello production

$ echo "HELLO=production" &gt; .env.production

$ dotenvx run -f .env.production --quiet -- node index.js
Hello production

$ DOTENV_CONFIG_QUIET=true dotenvx run -f .env.production -- node index.js
Hello production

$ echo "HELLO=production" &gt; .env.production

$ dotenvx run -f .env.production --log-level=error -- node index.js
Hello production

$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=env" &gt; .env

$ dotenvx run --convention=nextjs -- node index.js
Hello development local

$ dotenvx run --convention=flow -- node index.js
Hello development local

$ dotenvx encrypt
◈ encrypted (.env)

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env
Hello World

$ echo "HELLO=Production" &gt; .env.production
$ dotenvx encrypt -f .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ DOTENV_PRIVATE_KEY_PRODUCTION="&lt;.env.production private key&gt;" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env.production
Hello Production

$ echo "HELLO=Ci" &gt; .env.ci
$ dotenvx encrypt -f .env.ci
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ DOTENV_PRIVATE_KEY_CI="&lt;.env.ci private key&gt;" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env.ci
Hello Ci

$ dotenvx set HELLO World -f .env
$ dotenvx set HELLO Production -f .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ DOTENV_PRIVATE_KEY="&lt;.env private key&gt;" DOTENV_PRIVATE_KEY_PRODUCTION="&lt;.env.production private key&gt;" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (3) from .env, .env.production
Hello World

my-monorepo/
  .env
  .env.keys
  apps/
    web/
      index.js

$ cd apps/web

$ dotenvx get HELLO -f ../..
World

$ dotenvx run -f ../.. -- node index.js
[dotenvx@1.X.X] injecting env (1) from ../../.env
Hello World

$ dotenvx run -f ../.. --convention=nextjs -- node index.js
[dotenvx@1.X.X] injecting env (1) from ../../.env.development.local, ../../.env.local, ../../.env.development, ../../.env
Hello development local

$ dotenvx run -f . -fk ../.. -- node index.js

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt --stdout
$ dotenvx encrypt --stdout &gt; .env.encrypted

# .env
USERNAME="username"
DATABASE_URL="postgres://${USERNAME}@localhost/my_database"

// index.js
console.log('DATABASE_URL', process.env.DATABASE_URL)

$ dotenvx run --debug -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env
DATABASE_URL postgres://username@localhost/my_database

# .env
# Default value syntax: use value if set, otherwise use default
DATABASE_HOST=${DB_HOST:-localhost}
DATABASE_PORT=${DB_PORT:-5432}

# Alternative syntax (no colon): use value if set, otherwise use default
API_URL=${API_BASE_URL-https://api.example.com}

// index.js
console.log('DATABASE_HOST', process.env.DATABASE_HOST)
console.log('DATABASE_PORT', process.env.DATABASE_PORT)
console.log('API_URL', process.env.API_URL)

$ dotenvx run --debug -- node index.js
[dotenvx@1.X.X] injecting env (3) from .env
DATABASE_HOST localhost
DATABASE_PORT 5432
API_URL https://api.example.com

# .env
NODE_ENV=production

# Alternate value syntax: use alternate if set and non-empty, otherwise empty
DEBUG_MODE=${NODE_ENV:+false}
LOG_LEVEL=${NODE_ENV:+error}

# Alternative syntax (no colon): use alternate if set, otherwise empty  
CACHE_ENABLED=${NODE_ENV+true}

// index.js
console.log('NODE_ENV', process.env.NODE_ENV)
console.log('DEBUG_MODE', process.env.DEBUG_MODE)
console.log('LOG_LEVEL', process.env.LOG_LEVEL)
console.log('CACHE_ENABLED', process.env.CACHE_ENABLED)

$ dotenvx run --debug -- node index.js
[dotenvx@1.X.X] injecting env (4) from .env
NODE_ENV production
DEBUG_MODE false
LOG_LEVEL error
CACHE_ENABLED true

# .env
DEFINED_VAR=hello
EMPTY_VAR=
# UNDEFINED_VAR is not set

# Default value syntax - use variable if set/non-empty, otherwise use default
TEST1=${DEFINED_VAR:-fallback}     # Result: "hello"
TEST2=${EMPTY_VAR:-fallback}       # Result: "fallback"  
TEST3=${UNDEFINED_VAR:-fallback}   # Result: "fallback"

# Default value syntax (no colon) - use variable if set, otherwise use default
TEST4=${DEFINED_VAR-fallback}      # Result: "hello"
TEST5=${EMPTY_VAR-fallback}        # Result: "" (empty, but set)
TEST6=${UNDEFINED_VAR-fallback}    # Result: "fallback"

# Alternate value syntax - use alternate if variable is set/non-empty, otherwise empty
TEST7=${DEFINED_VAR:+alternate}    # Result: "alternate"
TEST8=${EMPTY_VAR:+alternate}      # Result: "" (empty)
TEST9=${UNDEFINED_VAR:+alternate}  # Result: "" (empty)

# Alternate value syntax (no colon) - use alternate if variable is set, otherwise empty  
TEST10=${DEFINED_VAR+alternate}    # Result: "alternate"
TEST11=${EMPTY_VAR+alternate}      # Result: "alternate" (empty but set)
TEST12=${UNDEFINED_VAR+alternate}  # Result: "" (empty)

# .env
DATABASE_URL="postgres://$(whoami)@localhost/my_database"

// index.js
console.log('DATABASE_URL', process.env.DATABASE_URL)

$ dotenvx run --debug -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env
DATABASE_URL postgres://yourusername@localhost/my_database

$ dotenvx run --env="HELLO=World" -- sh -c 'echo Hello $HELLO'
Hello World

# .env
MULTILINE_PEM="-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
u4QuUoobAgMBAAE=
-----END PUBLIC KEY-----"

// index.js
console.log('MULTILINE_PEM', process.env.MULTILINE_PEM)

$ dotenvx run -- node index.js
MULTILINE_PEM -----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
kKcI5jHYc8VJq+KCuRZrvn+3V+KuL9tF9v8ZgjF2PZbU+LsCy5Yqg1M8f5Jp5f6V
u4QuUoobAgMBAAE=
-----END PUBLIC KEY-----

$ dotenvx run -f .env.missing -- echo $HELLO
[MISSING_ENV_FILE] missing file (/Users/scottmotte/Code/dotenvx/playground/apr-16/.env.missing). fix: [echo "HELLO=World" &gt; .env.missing]

$ echo "HELLO=World" &gt; .env
$ dotenvx get GOODBYE
[MISSING_KEY] missing key (GOODBYE)

# .env
API_KEY=op://Personal/my_api_key/password

$ dotenvx run -- node index.js

$ dotenvx run --no-1password -- node index.js

# .env
API_KEY="bw://My GitHub Account/password"

$ dotenvx run --no-bitwarden -- node index.js

$ dotenvx run -f ../.. -- node index.js
[dotenvx@1.X.X] injecting env (1) from ../../.env
Hello World

$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=World" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.local -f .env -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local, .env
Hello local

$ echo "HELLO=World" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run --env HELLO=String -f .env -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env, and --env flag
Hello String

$ echo "SECRET=super-secret-value" &gt; .env
$ echo "VISIBLE_PLAIN=visible-value" &gt;&gt; .env
$ echo "console.log(process.env.SECRET, process.env.VISIBLE_PLAIN)" &gt; index.js

$ dotenvx run --redact --quiet -- node index.js
[REDACTED] visible-value

$ echo "SECRET=super-secret-value" &gt; .env

$ dotenvx run --redact --quiet -- claude -p 'Print the value of $SECRET'
[REDACTED]

$ echo "SECRET=super-secret-value" &gt; .env

$ dotenvx run --redact --quiet -- claude

$ echo "SECRET=super-secret-value" &gt; .env

$ dotenvx run --redact --quiet -- codex exec 'Print the value of $SECRET'
[REDACTED]

$ echo "SECRET=super-secret-value" &gt; .env

$ dotenvx run --redact --quiet -- codex

$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=World" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.local -f .env --overload -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local, .env
Hello World

# .env.prod contains: MODEL_REGISTRY=registry.company.com/models/v1
$ echo "MODEL_REGISTRY=registry.company.com/models/v1" &gt; .env.prod
$ echo "console.log('MODEL_REGISTRY:', process.env.MODEL_REGISTRY)" &gt; app.js

# Without environment variable set - uses .env.prod value
$ dotenvx run -f .env.prod -- node app.js
MODEL_REGISTRY: registry.company.com/models/v1

# With environment variable set (e.g., via Azure Container Service) - environment variable takes precedence
$ MODEL_REGISTRY=registry.azure.com/models/v2 dotenvx run -f .env.prod -- node app.js
MODEL_REGISTRY: registry.azure.com/models/v2

# To force .env.prod to override environment variables, use --overload
$ MODEL_REGISTRY=registry.azure.com/models/v2 dotenvx run -f .env.prod --overload -- node app.js
MODEL_REGISTRY: registry.company.com/models/v1

$ touch .env
$ dotenvx set HELLO encrypted
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

# check your .env.keys files for your privateKey
$ DOTENV_PRIVATE_KEY="122...0b8" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env
Hello encrypted

$ touch .env.production
$ dotenvx set HELLO "production encrypted" -f .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

# check .env.keys for your privateKey
$ DOTENV_PRIVATE_KEY_PRODUCTION="122...0b8" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env.production
Hello production encrypted

$ touch .env.ci
$ dotenvx set HELLO "ci encrypted" -f .env.ci
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

# check .env.keys for your privateKey
$ DOTENV_PRIVATE_KEY_CI="122...0b8" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (2) from .env.ci
Hello ci encrypted

$ touch .env
$ touch .env.production
$ dotenvx set HELLO encrypted
$ dotenvx set HELLO "production encrypted" -f .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

# check .env.keys for your privateKeys
$ DOTENV_PRIVATE_KEY="122...0b8" DOTENV_PRIVATE_KEY_PRODUCTION="122...0b8" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (3) from .env, .env.production
Hello encrypted

$ DOTENV_PRIVATE_KEY_PRODUCTION="122...0b8" DOTENV_PRIVATE_KEY="122...0b8" dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (3) from .env.production, .env
Hello production encrypted

$ echo "HELLO=production" &gt; .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.production --verbose -- node index.js
loading env from .env.production (/path/to/.env.production)
HELLO set
[dotenvx@1.X.X] injecting env (1) from .env.production
Hello production

$ echo "HELLO=production" &gt; .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.production --debug -- node index.js
process command [node index.js]
options: {"env":[],"envFile":[".env.production"]}
loading env from .env.production (/path/to/.env.production)
{"HELLO":"production"}
HELLO set
HELLO set to production
[dotenvx@1.X.X] injecting env (1) from .env.production
executing process command [node index.js]
expanding process command to [/opt/homebrew/bin/node index.js]
Hello production

$ echo "HELLO=production" &gt; .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.production --quiet -- node index.js
Hello production

$ DOTENV_CONFIG_QUIET=true dotenvx run -f .env.production -- node index.js
Hello production

$ echo "HELLO=production" &gt; .env.production
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.production --log-level=error -- node index.js
Hello production

# .env.example
DATABASE_URL=
API_KEY=
SENTRY_DSN= # optional

$ dotenvx run --validate -- node index.js
[VALIDATION_FAILED] missing required (DATABASE_URL, API_KEY). fix: [https://github.com/dotenvx/dotenvx/issues/907]

$ dotenvx run --validate --strict -- node index.js

$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.missing --strict -- node index.js
[MISSING_ENV_FILE] missing file (/path/to/.env.missing). fix: [echo "HELLO=World" &gt; .env.missing]

$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run -f .env.missing --ignore=MISSING_ENV_FILE -- node index.js
...

$ DOTENV_CONFIG_IGNORE="MISSING_ENV_FILE,OTHER_ERROR_CODE" dotenvx run -f .env.missing -- node index.js

$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=env" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx run --convention=nextjs -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.local, .env.development, .env
Hello development local

$ DOTENV_CONFIG_CONVENTION=nextjs dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.local, .env.development, .env
Hello development local

$ dotenvx run -f ../.. --convention=nextjs -- node index.js
[dotenvx@1.X.X] injecting env (1) from ../../.env.development.local, ../../.env.local, ../../.env.development, ../../.env
Hello development local

$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=env" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ NODE_ENV=development dotenvx run --convention=flow -- node index.js 
[dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.development, .env.local, .env
Hello development local

$ NODE_ENV=development DOTENV_CONFIG_CONVENTION=flow dotenvx run -- node index.js
[dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.development, .env.local, .env
Hello development local

$ DOTENV_ENV=development dotenvx run --convention=flow -- node index.js 
[dotenvx@1.X.X] injecting env (1) from .env.development.local, .env.development, .env.local, .env
Hello development local

$ mkdir -p apps/app1
$ touch apps/app1/.env
$ dotenvx set HELLO World -fk .env.keys -f apps/app1/.env

$ dotenvx run -fk .env.keys -f apps/app1/.env -- yourcommand

$ echo "SECRET=abcdefghijkl" &gt; .env
$ echo "console.log(process.env.SECRET)" &gt; index.js

$ dotenvx run --mask --quiet -- node index.js
abcdef******

$ dotenvx run --token "$DOTENVX_ARMOR_TOKEN" -- yourcommand

$ dotenvx run --no-native -- yourcommand

$ dotenvx run --no-armor -- yourcommand

$ echo "HELLO=World" &gt; .env

$ dotenvx get HELLO
World

$ echo "SECRET=abcdefghijkl" &gt; .env

$ dotenvx get SECRET --mask
abcdef******

$ dotenvx get HELLO --no-native

$ dotenvx get HELLO --no-armor
World

$ dotenvx get HELLO --ignore=MISSING_ENV_FILE

$ dotenvx get HELLO --ignore=MISSING_ENV_FILE MISSING_KEY

$ DOTENV_CONFIG_IGNORE=MISSING_ENV_FILE,OTHER dotenvx get HELLO

$ echo "HELLO=World" &gt; .env
$ echo "HELLO=production" &gt; .env.production

$ dotenvx get HELLO -f .env.production
production

$ dotenvx get HELLO -f ../..
World

$ mkdir -p apps/app1
$ touch apps/app1/.env
$ dotenvx set HELLO World -fk .env.keys -f apps/app1/.env

$ dotenvx get HELLO -fk .env.keys -f apps/app1/.env
world

$ dotenvx get HELLO --env HELLO=String -f .env.production
String

$ echo "HELLO=World" &gt; .env
$ echo "HELLO=production" &gt; .env.production

$ dotenvx get HELLO -f .env.production --env HELLO=String -f .env --overload
World

$ dotenvx get DOES_NOT_EXIST --strict
[MISSING_KEY] missing key (DOES_NOT_EXIST)

$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=env" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ dotenvx get HELLO --convention=nextjs
development local

$ DOTENV_CONFIG_CONVENTION=nextjs dotenvx get HELLO
development local

$ dotenvx get HELLO -f ../.. --convention=nextjs
development local

$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=env" &gt; .env
$ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

$ NODE_ENV=development dotenvx get HELLO --convention=flow
development local

$ NODE_ENV=development DOTENV_CONFIG_CONVENTION=flow dotenvx get HELLO
development local

$ DOTENV_ENV=development dotenvx get HELLO --convention=flow
development local

$ echo "HELLO=World" &gt; .env

$ dotenvx get
{"HELLO":"World"}

$ echo "HELLO=World" &gt; .env

$ dotenvx get --pretty-print
{
  "HELLO": "World"
}

$ echo "HELLO=World\nHOLA=Mundo\nGOODBYE=World" &gt; .env

$ dotenvx get -ik "H*"
{"HELLO":"World","HOLA":"Mundo"}

$ echo "DOTENV_PUBLIC_KEY=public\nHELLO=World" &gt; .env

$ dotenvx get --format=eval-export -ek "DOTENV_PUBLIC_KEY*"
export HELLO='World'

$ echo "HELLO=World" &gt; .env

$ dotenvx get --format colon
HELLO: World

$ echo "HELLO=World" &gt; .env
$ echo "KEY=value" &gt;&gt; .env

$ dotenvx get --format shell
HELLO=World KEY=value

$ echo "console.log('Hello ' + process.env.KEY + ' ' + process.env.HELLO)" &gt; index.js
$ env $(dotenvx get --format=shell) node index.js
Hello value World

$ echo "console.log('Hello ' + process.env.KEY + ' ' + process.env.HELLO)" &gt; index.js
$ export $(dotenvx get --format=shell)
$ node index.js
Hello value World

$ echo "HELLO=World" &gt; .env
$ echo "KEY=value" &gt;&gt; .env

$ dotenvx get --format eval
HELLO="World"
KEY="value"

$ echo "console.log('Hello ' + process.env.KEY + ' ' + process.env.HELLO)" &gt; index.js
$ eval $(dotenvx get --format=eval) node index.js
Hello value World

$ echo "HELLO=World" &gt; .env

$ dotenvx get --all
{"PWD":"/some/file/path","USER":"username","LIBRARY_PATH":"/usr/local/lib", ..., "HELLO":"World"}

$ echo "HELLO=World" &gt; .env

$ dotenvx get --all --pretty-print
{
  "PWD": "/some/filepath",
  "USER": "username",
  "LIBRARY_PATH": "/usr/local/lib",
  ...,
  "HELLO": "World"
}

$ touch .env

$ dotenvx set HELLO World
set HELLO with encryption (.env)

$ touch .env.production

$ dotenvx set HELLO production -f .env.production
set HELLO with encryption (.env.production)

$ mkdir -p apps/app1
$ touch apps/app1/.env

$ dotenvx set HELLO World -fk .env.keys -f apps/app1/.env
set HELLO with encryption (.env)

$ dotenvx get -fk .env.keys -f apps/app1/.env

$ cd apps/app1
$ dotenvx get -fk ../../.env.keys -f .env

$ touch .env.ci

$ dotenvx set HELLO "my ci" -f .env.ci
set HELLO with encryption (.env.ci)

$ touch .env.ci

$ dotenvx set HELLO -f .env.ci -- "- + * ÷"
set HELLO with encryption (.env.ci)

$ touch .env

$ dotenvx set HELLO World --plain
set HELLO (.env)

$ touch .env

$ dotenvx set HELLO_PLAIN World
set HELLO_PLAIN (.env)

$ dotenvx set HELLO World --no-native

$ dotenvx set HELLO World --no-armor
◈ encrypted HELLO (.env)

$ dotenvx set HELLO World -f .env.production --no-create

$ echo "HELLO=World" &gt; .env

$ dotenvx encrypt
◈ encrypted (.env) + local key (.env.keys)
⮕  next run [dotenvx gitignore --pattern .env.keys] to gitignore .env.keys
⮕  next run [DOTENV_PRIVATE_KEY='122...0b8' dotenvx run -- yourcommand] to test decryption locally

$ echo "HELLO=World" &gt; .env
$ echo "HELLO=Production" &gt; .env.production

$ dotenvx encrypt -f .env.production
◈ encrypted (.env.production) + local key (.env.keys)
⮕  next run [dotenvx gitignore --pattern .env.keys] to gitignore .env.keys
⮕  next run [DOTENV_PRIVATE_KEY='bff...bc4' dotenvx run -- yourcommand] to test decryption locally

$ dotenvx encrypt --no-native
◈ encrypted (.env)

$ dotenvx encrypt --no-armor
◈ encrypted (.env)

$ dotenvx encrypt --token token
◈ encrypted (.env) · armored ⛨

$ dotenvx encrypt -f .env.production --no-create

$ mkdir -p apps/app1
$ echo "HELLO=World" &gt; apps/app1/.env

$ dotenvx encrypt -fk .env.keys -f apps/app1/.env
◈ encrypted (apps/app1/.env)

$ dotenvx run -fk .env.keys -f apps/app1/.env

$ cd apps/app1
$ dotenvx run -fk ../../.env.keys -f .env

$ echo "HELLO=World\nHELLO2=Universe" &gt; .env

$ dotenvx encrypt -k HELLO2
◈ encrypted (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env

$ dotenvx encrypt -k "HE*"
◈ encrypted (.env)

$ echo "HELLO=World\nHELLO2=Universe" &gt; .env

$ dotenvx encrypt -ek HELLO
◈ encrypted (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env

$ dotenvx encrypt -ek "HO*"
◈ encrypted (.env)

$ echo "HELLO=World\nHELLO_PLAIN=visible" &gt; .env

$ dotenvx encrypt
◈ encrypted (.env)

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt --stdout
#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
#/            public-key encryption for .env files          /
#/       [how it works](https://dotenvx.com/encryption)     /
#/----------------------------------------------------------/
DOTENV_PUBLIC_KEY="034af93e93708b994c10f236c96ef88e47291066946cce2e8d98c9e02c741ced45"
# .env
HELLO="encrypted:BDqDBibm4wsYqMpCjTQ6BsDHmMadg9K3dAt+Z9HPMfLEIRVz50hmLXPXRuDBXaJi/LwWYEVUNiq0HISrslzQPaoyS8Lotg3gFWJTsNCdOWnqpjF2xNUX2RQiP05kAbEXM6MWVjDr"

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt --stdout &gt; somefile.txt

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt
◈ encrypted (.env)
$ dotenvx decrypt
◇ decrypted (.env)

$ dotenvx decrypt --no-native
◇ decrypted (.env)

$ dotenvx decrypt --no-armor
◇ decrypted (.env)

$ echo "HELLO=World" &gt; .env
$ echo "HELLO=Production" &gt; .env.production

$ dotenvx encrypt -f .env.production
◈ encrypted (.env.production)
$ dotenvx decrypt -f .env.production
◇ decrypted (.env.production)

$ mkdir -p apps/app1
$ echo "HELLO=World" &gt; apps/app1/.env

$ dotenvx encrypt -fk .env.keys -f apps/app1/.env
◈ encrypted (apps/app1/.env)
$ dotenvx decrypt -fk .env.keys -f apps/app1/.env
◇ decrypted (apps/app1/.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
◈ encrypted (.env)
$ dotenvx decrypt -k HELLO
◇ decrypted (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
◈ encrypted (.env)
$ dotenvx decrypt -k "HE*"
◇ decrypted (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
◈ encrypted (.env)
$ dotenvx decrypt -ek HOLA
◇ decrypted (.env)

$ echo "HELLO=World\nHOLA=Mundo" &gt; .env
$ dotenvx encrypt
◈ encrypted (.env)
$ dotenvx decrypt -ek "HO*"
◇ decrypted (.env)

$ dotenvx decrypt --stdout
#/-------------------[DOTENV_PUBLIC_KEY]--------------------/
#/            public-key encryption for .env files          /
#/       [how it works](https://dotenvx.com/encryption)     /
#/----------------------------------------------------------/
DOTENV_PUBLIC_KEY="034af93e93708b994c10f236c96ef88e47291066946cce2e8d98c9e02c741ced45"
# .env
HELLO="World"

$ dotenvx decrypt --stdout &gt; somefile.txt

$ echo "SECRET=abcdefghijkl" &gt; .env
$ dotenvx encrypt
◈ encrypted (.env)

$ dotenvx decrypt --stdout --mask
...
SECRET="abcdef******"

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt

$ dotenvx keypair
{"DOTENV_PUBLIC_KEY":"","DOTENV_PRIVATE_KEY":""}

$ dotenvx keypair --no-native
{"DOTENV_PUBLIC_KEY":"","DOTENV_PRIVATE_KEY":""}

$ dotenvx keypair --no-armor
{"DOTENV_PUBLIC_KEY":"","DOTENV_PRIVATE_KEY":""}

$ echo "HELLO=Production" &gt; .env.production
$ dotenvx encrypt -f .env.production

$ dotenvx keypair -f .env.production
{"DOTENV_PUBLIC_KEY_PRODUCTION":"","DOTENV_PRIVATE_KEY_PRODUCTION":""}

$ mkdir -p apps/app1
$ echo "HELLO=World" &gt; apps/app1/.env
$ dotenvx encrypt -fk .env.keys -f apps/app1/.env

$ dotenvx keypair -fk .env.keys -f apps/app1/.env
{"DOTENV_PUBLIC_KEY":"","DOTENV_PRIVATE_KEY":""}

$ echo "HELLO=World" &gt; .env
$ dotenvx encrypt

$ dotenvx keypair DOTENV_PRIVATE_KEY

$ echo "HELLO=World" &gt; .env
$ dotenx encrypt

$ dotenvx keypair --format shell
DOTENV_PUBLIC_KEY= DOTENV_PRIVATE_KEY=

$ dotenvx keypair --format colon
DOTENV_PUBLIC_KEY: DOTENV_PRIVATE_KEY:

$ dotenvx keypair --format json
{"DOTENV_PUBLIC_KEY":"","DOTENV_PRIVATE_KEY":""}

$ dotenvx keypair --pretty-print
{
  "DOTENV_PUBLIC_KEY": "",
  "DOTENV_PRIVATE_KEY": ""
}

$ touch .env
$ touch .env.production
$ mkdir -p apps/backend
$ touch apps/backend/.env

$ dotenvx ls
├─ .env.production
├─ .env
└─ apps
   └─ backend
      └─ .env

$ touch .env
$ touch .env.production
$ mkdir -p apps/backend
$ touch apps/backend/.env

$ dotenvx ls apps/backend
└─ .env

$ touch .env
$ touch .env.production
$ mkdir -p apps/backend
$ touch apps/backend/.env
$ touch apps/backend/.env.prod

$ dotenvx ls -f **/.env.prod*
├─ .env.production
└─ apps
   └─ backend
      └─ .env.prod

$ touch .env
$ touch .env.production
$ mkdir -p apps/backend
$ touch apps/backend/.env
$ touch apps/backend/.env.prod

$ dotenvx ls -ef '**/.env.prod*'
├─ .env
└─ apps
   └─ backend
      └─ .env

$ dotenvx ls --json
[
  "/path/to/project/.env",
  "/path/to/project/apps/backend/.env"
]

$ dotenvx ls --json &gt; dotenv-files.json

# .env.example
DATABASE_URL=
API_KEY=
SENTRY_DSN= # optional

$ dotenvx validate
[VALIDATION_FAILED] missing required (DATABASE_URL, API_KEY). fix: [https://github.com/dotenvx/dotenvx/issues/907]

$ dotenvx validate -f .env.production -fk .env.keys

$ dotenvx validate --ignore=MISSING_ENV_EXAMPLE

$ dotenvx validate --ignore=MISSING_ENV_FILE MISSING_ENV_EXAMPLE

$ DOTENV_CONFIG_IGNORE=MISSING_ENV_FILE,OTHER dotenvx validate

$ echo "HELLO=World" &gt; .env

$ dotenvx genexample
▣ generated (.env.example)

# .env.example
HELLO=""

$ echo "HELLO=World" &gt; .env
$ echo "DB_HOST=example.com" &gt; .env.production

$ dotenvx genexample -f .env -f .env.production
▣ generated (.env.example)

# .env.example
HELLO=""
DB_HOST=""

$ echo "HELLO=World" &gt; .env
$ mkdir -p apps/backend
$ echo "HELLO=Backend" &gt; apps/backend/.env

$ dotenvx genexample apps/backend
▣ generated (.env.example)

# apps/backend/.env.example
HELLO=""

$ dotenvx gitignore
▣ ignored .env* (.gitignore)

$ dotenvx gitignore --pattern .env.keys
▣ ignored .env.keys (.gitignore)

$ dotenvx precommit
▣ .env files (1) protected (encrypted or gitignored)

$ dotenvx precommit --install
▣ dotenvx precommit installed [.git/hooks/pre-commit]

$ echo "HELLO=World" &gt; .env
$ mkdir -p apps/backend
$ echo "HELLO=Backend" &gt; apps/backend/.env

$ dotenvx precommit apps/backend
▣ apps/backend/.env not protected (encrypted or gitignored)

# Install via script
RUN curl -fsS https://dotenvx.sh | sh

# Or copy binary from official image
COPY --from=dotenv/dotenvx:latest /usr/local/bin/dotenvx /bin/local/bin

# ... orther container commands

RUN dotenvx prebuild
CMD ["/usr/local/bin/dotenvx", "run", "--", "node", "index.js"]

# Install via script
RUN curl -fsS https://dotenvx.sh | sh

# Or copy binary from official image
COPY --from=dotenv/dotenvx:latest /usr/local/bin/dotenvx /bin/local/bin

# ... orther container commands

RUN dotenvx prebuild apps/backend
CMD ["/usr/local/bin/dotenvx", "run", "--", "node", "apps/backend/index.js"]

# example
DOTENV_PRIVATE_KEY=locked:02f5b97ad58b49ae324cd4e7937bc19b251d006b31cacf46f789eeaf03f923cedc:AZIPDxKqjPLiGl5b4CqVGbR3CIBDUcqHthGaoeWLoUvxbTHJkj3jGoGWGaxFSDUJGQUmWDaExRzxKpVydYF_7qiWr1ecqksOFho5t3EMwKbqX2-y-LZO9K3a4SJaYAjDJXpn3NwG4vAt1oLmGA

$ dotenvx lock up

# .env.keys
DOTENV_PRIVATE_KEY=locked:02f5b97ad58b49ae324cd4e7937bc19b251d006b31cacf46f789eeaf03f923cedc:AZIPDxKqjPLiGl5b4CqVGbR3CIBDUcqHthGaoeWLoUvxbTHJkj3jGoGWGaxFSDUJGQUmWDaExRzxKpVydYF_7qiWr1ecqksOFho5t3EMwKbqX2-y-LZO9K3a4SJaYAjDJXpn3NwG4vAt1oLmGA

$ dotenvx lock up -f .env.production -fk .env.keys

$ dotenvx lock down

$ dotenvx native up

$ dotenvx native up -f .env.production -fk .env.keys

$ dotenvx native down

$ dotenvx native push

$ dotenvx native pull

$ dotenvx armor login
$ dotenvx armor up

$ dotenvx armor up -f .env.production --team acme

$ dotenvx armor down

$ dotenvx armor push

$ dotenvx armor pull

$ dotenvx armor pull -f .env.production --token "$DOTENVX_ARMOR_TOKEN"

$ dotenvx armor open

$ dotenvx armor open -f .env.production

$ dotenvx armor move --team acme

$ dotenvx armor login

$ dotenvx armor logout

$ dotenvx armor status
on

$ dotenvx armor settings username
$ dotenvx armor settings token
$ dotenvx armor settings device
$ dotenvx armor settings hostname
$ dotenvx armor settings path
$ dotenvx armor settings on
$ dotenvx armor settings off

$ dotenvx armor settings token --unmask
$ dotenvx armor settings device --unmask

$ dotenvx help
Usage: dotenvx run -- yourcommand

a secure dotenv–from the creator of `dotenv`

Options:
  -l, --log-level       set log level (default: "info")
  -q, --quiet                  sets log level to error
  -v, --verbose                sets log level to verbose
  -d, --debug                  sets log level to debug
  -V, --version                output the version number
  -h, --help                   display help for command

Commands:
  run                inject env at runtime [dotenvx run -- yourcommand]
  get [KEY]          return a single environment variable
  set    set a single environment variable
  encrypt            encrypt .env file(s)
  decrypt            decrypt .env file(s)
  keypair [KEY]      print public/private keys for .env file(s)
  ls [directory]     print all .env files in a tree structure
  gitignore          append to .gitignore
  genexample [directory]
                     generate .env.example
  validate           validate .env file(s) against .env.example
  precommit [directory]
                     prevent committing .env files to code
  prebuild [directory]
                     prevent including .env files in docker
 
Professional Security: 
  lock                     ⊡ lock private keys with a local passphrase
  native                   ⌥ move private keys into your OS secret store
  armor                    ⛨ move private keys into Dotenvx Armor [www.dotenvx.com/armor]

$ dotenvx help run
Usage: @dotenvx/dotenvx run [options]

inject env at runtime [dotenvx run -- yourcommand]

Options:
  -e, --env             environment variable(s) set as string (example: "HELLO=World") (default: [])
  -f, --env-file          path(s) to your env file(s) (default: [])
  -fv, --env-vault-file   path(s) to your .env.vault file(s) (default: [])
  -o, --overload                    override existing env variables
  --convention                load a .env convention (available conventions: ['nextjs'])
  -h, --help                        display help for command

Examples:

  $ dotenvx run -- npm run dev
  $ dotenvx run -- flask --app index run
  $ dotenvx run -- php artisan serve
  $ dotenvx run -- bin/rails s

Try it:

  $ echo "HELLO=World" &gt; .env
  $ echo "console.log('Hello ' + process.env.HELLO)" &gt; index.js

  $ dotenvx run -- node index.js
  [dotenvx@1.X.X] injecting env (1) from .env
  Hello World

$ dotenvx --version
X.X.X

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config()

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
[dotenvx@1.X.X] injecting env (1) from .env
Hello World

# .env
SECRET="abcdefghijkl"

// index.js
const dotenvx = require('@dotenvx/dotenvx')
const result = dotenvx.config({ mask: true, quiet: true })

console.log(process.env.SECRET)
console.log(result.parsed.SECRET)

$ node index.js
abcdef******
abcdef******

# .env.local
HELLO="Me"

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env.local', '.env']})

// esm
// import dotenvx from "@dotenvx/dotenvx";
// dotenvx.config({path: ['.env.local', '.env']});

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local, .env
Hello Me

# .env.local
HELLO="Me"

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env.local', '.env'], overload: true})

// esm
// import dotenvx from "@dotenvx/dotenvx";
// dotenvx.config({path: ['.env.local', '.env'], overload: true});

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
[dotenvx@1.X.X] injecting env (1) from .env.local, .env
Hello World

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env.missing', '.env'], quiet: true})

// esm
// import dotenvx from "@dotenvx/dotenvx";
// dotenvx.config({path: ['.env.missing', '.env'], quiet: true});

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
Hello World

$ DOTENV_CONFIG_QUIET=true node index.js
Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)
Hello World

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env.missing', '.env'], strict: true})

// esm
// import dotenvx from "@dotenvx/dotenvx";
// dotenvx.config({path: ['.env.missing', '.env'], strict: true});

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
Error: [MISSING_ENV_FILE] missing .env.missing file (/path/to/.env.missing)

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env.missing', '.env'], ignore: ['MISSING_ENV_FILE']})

// esm
// import dotenvx from "@dotenvx/dotenvx";
// dotenvx.config({path: ['.env.missing', '.env'], ignore: ['MISSING_ENV_FILE']});

console.log(`Hello ${process.env.HELLO}`)

$ node index.js
[dotenvx@1.X.X] injecting env (1) from .env
Hello World

# .env
HELLO="World"

// index.js
require('@dotenvx/dotenvx').config({path: ['.env'], envKeysFile: '../../.env.keys'})

# Setup environment files
$ echo "HELLO=development local" &gt; .env.development.local
$ echo "HELLO=local" &gt; .env.local
$ echo "HELLO=development" &gt; .env.development
$ echo "HELLO=env" &gt; .env

// index.js
require('@dotenvx/dotenvx').config({ convention: 'nextjs' })

console.log(`Hello ${process.env.HELLO}`)

$ NODE_ENV=development node index.js
[dotenvx@1.28.0] injecting env (1) from .env.development.local, .env.local, .env.development, .env
Hello development local

$ dotenvx run --convention=nextjs -- node index.js

$ DOTENV_CONFIG_CONVENTION=nextjs node index.js

// index.js
require('@dotenvx/dotenvx').config({
  path: 'apps/web',
  convention: 'nextjs'
})

apps/web/.env.development.local
apps/web/.env.local
apps/web/.env.development
apps/web/.env

// index.js
require('@dotenvx/dotenvx').config({noArmor: true})

# .env
API_KEY=op://Personal/my_api_key/password

// index.js
require('@dotenvx/dotenvx').config()

console.log(process.env.API_KEY)

// index.js
require('@dotenvx/dotenvx').config({no1Password: true})

# .env
API_KEY="bw://My GitHub Account/password"

// index.js
require('@dotenvx/dotenvx').config()

console.log(process.env.API_KEY)

// index.js
require('@dotenvx/dotenvx').config({noBitwarden: true})

// index.js
const dotenvx = require('@dotenvx/dotenvx')
const src = 'HELLO=World'
const parsed = dotenvx.parse(src)
console.log(`Hello ${parsed.HELLO}`)

$ node index.js
Hello World

// index.js
const dotenvx = require('@dotenvx/dotenvx')
const src = 'USER=Me'
const parsed = dotenvx.parse(src, { processEnv: {} })
console.log(`Hello ${parsed.USER}`)

$ node index.js
Hello Me

// index.js
const dotenvx = require('@dotenvx/dotenvx')
const src = 'HELLO="encrypted:BEiK4SwVe4rznIrZKW7qcnEBxo6Qxy0gv8xXiPN90N1jjhwkyVqzgoszZEI00tEeRWHsfQyJbCVy11qOEkkmERWbvOBzHve8/7WmVwyo5Z3HIOhlI45C+zmFgqmS2zMw9GPzHd9e"'
const parsed = dotenvx.parse(src, { privateKey: 'a4547dcd9d3429615a3649bb79e87edb62ee6a74b007075e9141ae44f5fb412c' })
console.log(`Hello ${parsed.HELLO}`)

$ node index.js
Hello World

// index.js
const dotenvx = require('@dotenvx/dotenvx')
dotenvx.set('HELLO', 'World', { path: '.env' })

// index.js
const dotenvx = require('@dotenvx/dotenvx')
dotenvx.set('HELLO', 'World', { plain: true })

// index.js
const dotenvx = require('@dotenvx/dotenvx')
const decryptedValue = await dotenvx.get('HELLO')
console.log(decryptedValue)

// index.js
const dotenvx = require('@dotenvx/dotenvx')
const maskedValue = await dotenvx.get('SECRET', { mask: true })
console.log(maskedValue)

$ node index.js
abcdef******

# config
DOTENV_CONFIG_CONVENTION= # set to a default convention like 'nextjs' or 'flow'
DOTENV_CONFIG_IGNORE= # MISSING_ENV_FILE,OTHER
DOTENV_CONFIG_QUIET= # set to "true" to default to --quiet

# armor
DOTENVX_ARMOR_TOKEN= # for api calls
DOTENVX_NO_ARMOR= # set to "true" to turn off Armor support

# 1password
DOTENVX_NO_1PASSWORD= # set to "true" to turn off 1Password support

# bitwarden
DOTENVX_NO_BITWARDEN= # set to "true" to turn off Bitwarden support
BW_SESSION= # set to bitwarden session token to bypass password prompt

# error codes
1PASSWORD_FAILED= # a value could not be resolved with the 1Password CLI
ACCESS_APPROVAL_TIMEOUT= # an Armor access-approval request timed out
BITWARDEN_FAILED= # a value could not be resolved with the Bitwarden CLI
COMMAND_EXITED_WITH_CODE= # the command run by dotenvx exited with a non-zero status
COMMAND_SUBSTITUTION_FAILED= # a $(command) expression in an environment value could not be evaluated
DECRYPTION_FAILED= # an encrypted value could not be decrypted
FILE_NOT_WRITABLE= # dotenvx could not write to the target file
INVALID_COLOR= # the requested terminal color is invalid
INVALID_CONVENTION= # the requested environment-file convention is invalid
INVALID_PASSPHRASE= # a locked private key could not be unlocked with the supplied passphrase
INVALID_PRIVATE_KEY= # a private key is malformed or otherwise invalid
INVALID_PUBLIC_KEY= # a public key is malformed or otherwise invalid
MALFORMED_ENCRYPTED_DATA= # the encrypted value is malformed
MISPAIRED_PRIVATE_KEY= # a private key does not match the existing public key
MISSING_DIRECTORY= # the requested directory does not exist
MISSING_ENV_EXAMPLE= # the required .env.example file does not exist
MISSING_ENV_FILE= # a requested environment file does not exist
MISSING_ENV_FILES= # no .env* files were found
MISSING_ENV_KEYS_FILE= # the requested .env.keys file does not exist
MISSING_KEY= # a requested environment key does not exist
MISSING_LOG_LEVEL= # the requested log level is not supported
MISSING_PRIVATE_KEY= # the private key required to decrypt a value is missing
MISSING_PUBLIC_KEY= # the public key required to encrypt a value is missing
MISSING_REQUIRED= # validation detail for which required variables are missing; surfaced by VALIDATION_FAILED
MISSING_VALUE= # no value was supplied for a key
NOT_FOUND= # a private key was not found in the native secret store
PRECOMMIT_HOOK_MODIFY_FAILED= # dotenvx could not update the pre-commit hook
VALIDATION_FAILED= # one or more required variables declared by .env.example are missing
WRONG_PRIVATE_KEY= # the supplied private key cannot decrypt the value

⛨ ARMORED KEYS: Harden your private keys.
⮕ install [curl -sfS https://dotenvx.sh/armor | sh]
⮕ then run [dotenvx armor login]

# from this:
./node_modules/.bin/dotenvx run --env-file .env -- yourcommand
# to this:
./node_modules/.bin/dotenvx run -f .env -- yourcommand

dotenvx dotenvx

README

Quickstart

Run Anywhere

Multiple Environments

Encryption

Advanced

CLI 📟

Library 📦

More

Armor ⛨

Quickstarts

FAQ

How does encryption work?

Is it safe to commit an encrypted .env file to code?

Why am I getting the error `node: .env: not found`?

Contributing

dotenvx dotenvx

README

Quickstart

Run Anywhere

Multiple Environments

Encryption

Advanced

CLI 📟

Library 📦

More

Armor ⛨

Quickstarts

FAQ

How does encryption work?

Is it safe to commit an encrypted .env file to code?

Why am I getting the error node: .env: not found?

Contributing

Why am I getting the error `node: .env: not found`?