Penv Cloud
Start free

Secrets manager for .env files and API keys.

Store, share and sync environment variables across your team, CI/CD and servers.

Start freeRead the docs
Install the CLI
curl -fsSL https://penv.cloud/install | sh
Windows and npm: install the CLI
~/acme/paymentszsh
$ penv push
Created project payments, environment development
Sent 4 values
Deleted .env
$ penv run -- pnpm dev
4 values valid against .env.schema
ready on http://localhost:3000
Revealed STRIPE_KEYLogged to the audit log: who, what, when.

Works with the CI, hosts and clouds you already use

One CI job, start to finish

  1. The job starts+30
  2. It signs in with OIDC15 min
  3. It reads the values$0 / machine
  4. We log the read14 days / Free

Stop sharing .env files in Slack.

Change a value once and every laptop, pipeline and server reads the new version.

  1. penv initWrites .env.schema from your .env.
  2. penv pushSends every value to us and deletes .env.
  3. penv run -- pnpm devValidates values and starts your app, in any clone.
Doppler
Imported from Dopplerpayments / production
18 values→ payments / production
Infisical
Imported from Infisicalpayments / staging
12 values→ payments / staging
.env.schema@env-spec
# @penv=acme/payments
# @currentEnv=$APP_ENV
# @type=enum(development,staging,production)
APP_ENV=development
# @type=url
DATABASE_URL=
# @type=string(startsWith=sk_) @rotate=90d
STRIPE_SECRET_KEY=
# @type=enum(debug,info,warn) @sensitive=false
LOG_LEVEL=match($APP_ENV, production: warn, _: debug)
QuickstartImport a .env file

CI/CD secrets without a stored token.

CI signs in with its platform's OIDC token, so you store no key.

Connect your CIGitHub Actions guide
.github/workflows/deploy.yml
permissions:
  id-token: write
steps:
  - run: curl -fsSL https://penv.cloud/install | sh
  - name: Deploy
    run: |
      # trade the GitHub OIDC token for a credential
      PENV_TOKEN="$C" penv run -- npm run deploy
Any server, with a keypair

An audit log for every secret read.

We log every read, write and reveal, and nobody can edit an entry.

Machine reads per daySep 20 to 26
12.5k served3 refused0 throttled
Response time by action
p50p95
credential.issue84 / 210 ms
secret.write41 / 120 ms
secret.read12 / 38 ms
How the audit log works

A person approves every value an agent asks for.

Under a coding agent, penv changes three things.

.env
penv refuses to write one.
Output
penv scrubs values from what the agent captures.
Reveal
We send each request to a person, on every plan.
Keep agents out of .env

Encrypted with AES-256-GCM and AWS KMS.

We seal each value under your workspace's own key, bound to its address.

How we encrypt your values

What you can check before you trust us

The CLI is open sourceAudit the source that runs on your laptop and in CI.Keys wrapped by AWS KMSAES-256-GCM per value, data keys wrapped in AWS KMS. SOC 2 audit in progress.Eight subprocessors, listedWho they are, what they touch, and whether they ever see plaintext.
Subprocessor register →

Billed per human seat. Machine identities are free.

Secrets, machines and API calls cost nothing extra, on any plan.

FreeFor a team of up to 3 people.
$0forever
  • 3 human seats, unlimited machines
  • 5 projects, 5 environments each
  • OIDC sign-in for CI
  • 14 days of audit log
Start free →
ProUnlimited projects and environments.
$18/ seat / monthBilled annually, or $22 month to month
  • Everything in Free, unlimited seats
  • Write-only environments for CI and deploys
  • Custom roles and alerts
  • 180 days of audit log
Start free →
EnterpriseSSO, an SLA, and a signed DPA.
Custom/ seat, annual
  • SAML SSO and SCIM
  • Your own wrapping key: AWS, GCP, Azure or Vault
  • Audit log streaming to your SIEM
  • SLA and a named engineer
Contact sales →
What's included in each plan →

Add machines. Your bill stays put.

Move the sliders to see what your team would pay on each platform.

91%less than Infisical
14%less than Doppler
$90 / month

Your CI runners, servers and preview deploys are identities too. Infisical bills each one. We bill only the people who sign in.

Start free
Your team, the monthly billPublic list prices, 24 Sep 2026
5
47
$90
Penv Cloud
$105
Doppler
$1,040
Infisical

Before you switch

Stuck on a migration?An engineer will help.Talk to an engineer →
How are my secrets protected?

Each value is sealed with a data key no other workspace shares and bound to its own address, and every reveal is logged: who, what, when.

Do I have to change my code?

No code change. Your app still reads environment variables. penv sets them when your app starts.

Do I need the penv CLI?

Setup and editing happen in the console. The open-source penv CLI loads the values into your app, and the quickstart covers it.

What does it cost?

Free for up to three people. Machines are never billed. Pro is $18 per seat per month, billed annually. Every plan gets the same encryption.

Can I leave?

Yes. penv pull writes your current values to a plain .env file that any dotenv reader accepts.

Get your API keys out of the chat.

Start freeRead the docs
No card. Upgrade in the console when you need more.