From vault to terminal.

Envault keeps application secrets organized by workspace, project, environment, and folder. Use the dashboard for your team and the CLI for your workflow.

Quickstart

Install Node.js 22 or newer, then install the CLI from this deployment.

npm install -g https://vault.prostacklabs.com/cli/latest.tgz
envault login
envault projects list
envault init --project <project-slug> --env development
envault run --project <project-slug> --env development -- npm run dev

login opens your browser and displays a device code. Sign in, confirm the code matches your terminal, and approve the request. Your CLI receives a revocable Better Auth session.

Project slugs

Select a project and open Settings to edit its Project slug. Owners and admins can change it. Use that slug in commands such as envault run --project my-app --env development -- npm run dev. Slugs are unique within a workspace; pass --workspace <workspace-id> if several accessible workspaces use the same slug. Machine tokens can resolve only their own project.

Changing a slug preserves the project ID, secrets, and machine tokens. Saved envault init defaults continue working. Update any explicit commands that use the old slug. Install the latest CLI to get slug editing and lookup across workspaces.

Sign in with a passkey

Sign in at vault.prostacklabs.com, open Settings, and choose Add passkey. Give it a name, then confirm your fingerprint, face, device PIN, or compatible security key. You can rename or remove passkeys in Settings. On your next visit, choose Sign in with a passkey.

Passkeys also work with envault login: sign in with your passkey in the browser, verify the device code, then authorize the CLI. Passkeys require a supported browser and belong to this domain. Device unlock completes passkey authentication; password login still asks for your authenticator code when two-factor authentication is enabled.

Your password manager uses your account email as the passkey username. A custom key name only labels the device in Envault. For an existing key with an old username, sign in with that passkey once to request a label update. If your password manager keeps the old name, edit its username there or register a replacement key.

Everyday commands

Use --project, --env, and --path on any secret command. init writes these defaults to .envault.json in the current directory. It contains project metadata, never credentials. Use --server to point the CLI at another Envault deployment.

Copying and one-time sharing

Use envault secrets copy --to staging to copy the selected folder into another environment. Matching keys create new versions. Use envault secrets share API_KEY --hours 24 to create an expiring link that can be opened once. The recipient needs no account. Manage and revoke links under Shared links. Link previews do not consume the secret.

CI/CD and machine tokens

Create a machine token in your project's Machine access screen. Choose read or write access, an optional environment, a folder, and an expiry. Store the token in your CI provider's encrypted secret store.

ENVAULT_TOKEN="$YOUR_CI_SECRET" envault run \
  --project <project-slug> --env production -- npm run build

The CLI removes ENVAULT_TOKEN from child processes. Injected secrets override existing environment variables. Child exit codes and termination signals are preserved. For machine-token management, use tokens list, tokens create name --permission read --env production --days 30, and tokens revoke <id>.

REST API

Use a Better Auth session or a machine token in the Authorization: Bearer header. All API responses are JSON and are marked Cache-Control: no-store. Cookie-authenticated mutations require a matching Origin header.

curl "https://vault.prostacklabs.com/api/v1/projects/<project-id>/export?environment=production&path=%2F" \
  -H "Authorization: Bearer $ENVAULT_TOKEN"

Secret, import, export, and folder endpoints accept ?environment=development&path=/. The environment can be a slug or ID. Secret creation accepts {"key":"API_KEY","value":"...","comment":"optional"}. Updates accept value, comment, and an optional expectedVersion to reject conflicting edits with HTTP 409. Restores require version and expectedVersion.

Access and encryption

Owners manage the entire workspace. Admins manage projects, machine access, and members. Developers create projects and modify secrets. Viewers can read and export secrets. Machine tokens inherit the creator's current membership and role, and cannot manage team access or create other tokens.

Secret values and all previous versions are encrypted with AES-256-GCM. Encryption binds each value to its project, environment, folder, and key. The server decrypts values only after authorization. This is server-managed encryption; it is not end-to-end encryption. Secret names, comments, and audit metadata are stored as plaintext, so keep credentials out of those fields.

Account security

Passwords require at least 12 characters. You can enable authenticator-based two-factor authentication, save backup codes, change your password, and revoke sessions from Settings. Team invitation links expire after seven days and are bound to the invited email address. Email verification, recovery emails, and social login are not configured on this deployment.