← Back to Discover

KeyEnv

KeyEnv is a command-line secrets manager that encrypts a team's environment secrets, controls access per environment, and logs every read.

Code & secrets security
Visit website ↗

What it does

KeyEnv is a secrets management product built for teams that ship from a terminal. It stores encrypted secrets and shares them only with the people, CI jobs, and processes that you allow. To start, run keyenv init to link a project folder to KeyEnv. Then run keyenv push to encrypt and share your existing .env file. Run keyenv run followed by a command, such as npm start, to start a process with secrets injected. After that, you can delete the .env file. The command-line tool installs with a curl command that runs an install script.

Capabilities

  • Access roles are set per environment and can be admin, write, read, or none.
  • The read log records who read which secret, when, and from where, for people, CI jobs, and AI agents.
  • Database passwords rotate on a schedule.
  • The keyenv scan command checks for hardcoded keys, and KeyEnv says it catches them before they ship.
  • Secrets are encrypted with AES-256-GCM at rest, and KeyEnv says they stay ciphertext until your code runs.

When to use it

  • You want to stop pasting a .env file into Slack and move your team onto encrypted secrets.
  • A new hire needs access to the development environment but not production.
  • You want the same commands to work in your shell, in CI, and for your AI agent.