Import from another tool
Two routes in the console and one at the command line. Which you want depends on whether the values sit in a file or in another service.
You already keep your keys and settings somewhere. Getting them here takes one of three routes, and which one you want depends on whether the values are in a file or in another service.
Drop a file on the console
Open Projects, pick the project and the environment, then Set Parameter. Drop a .env file
anywhere on the card, or paste one. Typing rows by hand still works.
The file is parsed in your browser and never uploaded. What reaches the server is a list of rows you have looked at, so no diagnostic about your file is ever generated from text this side holds.
What the parser handles:
| Input | What happens |
|---|---|
KEY=value and KEY: value | A row. A leading export is stripped |
| Quoted values | Single quotes stay literal. Double quotes expand \n, \r, \t, \\ and \" |
| A value spanning lines | An unclosed quote consumes lines until it closes, so a PEM body survives |
| A flat JSON object | Each key becomes a row |
| The same key twice | Two rows, both shown. Nothing is silently overwritten |
| A nested object or array | An empty row with a note saying to flatten it |
One hundred parameters at a time. A larger file goes in as two pastes, and the form says so rather than truncating.
Writing needs secret:write at that project and environment. The store assigns the version, so a
key that is new here lands as version 1 and a key that already exists gets the next version, with
the old one kept in the history. Each write is in the audit log.
Empty values are flagged before you submit, because a key with nothing behind it is usually a line that did not parse rather than a value you meant to leave blank.
Pull from a platform you already use
If your values are in another service, connect it and let Penv Cloud read them.
Open Integrations then Providers and pick the service. Connect it, then create a sync with its direction set to import. Doppler is the plainest example: it asks for a service token, then a project and a config per sync, and it never writes back. That direction is not something you turn off, because the adapter has no way to write at all.
One sync answers four questions:
| Setting | What it decides |
|---|---|
| Direction | Import reads from them. Export writes to them |
| Where it lands | The project and environment, plus an optional path prefix |
| What it reads | The remote scope, which is that service's own way of naming a folder |
| Conflict policy | skip_existing, new_version or fail |
skip_existing leaves anything already here alone. new_version writes a new version over what is
here, and the old version stays in the history. fail stops the run rather than guess.
Preview first. A preview reads names and never opens a value, so you can see exactly what a run
would touch before you approve it. Creating a sync needs integration:configure and running one
needs integration:run.
Use a service token rather than one tied to a person. Several platforms hand a restricted value to a service token and withhold it from a personal one, so a personal token imports rows that look empty for no visible reason.
Let penv read the file you have
If the values are already in a .env beside your code, penv init reads it and writes the schema,
then gitignores the file. It is the shortest route here, and it needs no account until you push.
See from a dotenv file.
After the import
Check the values landed where you meant them to. A path prefix on a sync, or a path typed into a row, puts a key somewhere the code reading it may not look.
Then delete the old copies. Your API keys are in someone's chat history, and importing them here does not take them out of it.
Do it in order
- Decide the route: the console for a file you hold, a connection for a service you already use.
- Create the project and the environment first, so nothing lands in the wrong place.
- Drop or paste the file, or connect the service and create an import sync.
- Preview, and read the row list before you write anything.
- Write, then open the environment and confirm the key names and the versions.
- Run
penv run -- <your command>against that environment and confirm your app starts. - Delete the old copies at the source, and rotate anything that was pasted into a chat.