Import from another tool
Three ways to bring your values to us: paste a .env file in the console, sync from another service, or run penv init on a local file.
| Your values are in | Route |
|---|---|
A .env or JSON file | Paste in the console |
| Another service | Import sync |
A .env beside the code | penv init |
Create your project and environment first, so nothing lands in the wrong place.
Paste a file in the console
Open Projects, pick the project and environment, then Set Parameter. Drop or paste a .env
file onto the card, or type rows.
Your browser parses the file and never uploads it; we receive only the rows you review and submit.
| Input | Result |
|---|---|
KEY=value, KEY: value, export KEY=value | A row |
| Quoted and multi-line values | Parsed as dotenv; a PEM body in an unclosed quote survives |
| A flat JSON object | One row per key |
| A duplicate key | Two rows, both shown; nothing is overwritten |
| A nested object or array | An empty row with a note to flatten it |
| An empty value | Flagged before submit, usually a line that did not parse |
The limit is 100 parameters per submit. Paste a larger file in two parts; the form says so rather than truncating.
Writing needs secret:write at that project and environment. A new key lands as version 1; an
existing key gets the next version and we keep the old one in history. We audit each write. See
parameters.
Sync from another service
Open Integrations then Providers, pick the service, connect it, and create a sync with direction set to import.
| Setting | Values |
|---|---|
| Direction | Import reads from the service; export writes to it |
| Destination | Project and environment, plus an optional path prefix |
| Remote scope | The service's own folder concept |
| Conflict policy | skip_existing, new_version or fail |
Preview before running: a preview reads names and never opens a value. Creating a sync needs
integration:configure; running one needs integration:run. How syncs
work covers conflict policies and previews.
Doppler asks for your service token, then a project and config per sync. Its adapter has no write path, so it is import only. See Doppler.
Use a service token, not your personal one. Several platforms withhold restricted values from personal tokens, so those rows import empty.
Run penv init on a local file
penv initpenv init reads .env, writes .env.schema, and gitignores the file. It sends
nothing; you sign in only for penv push. See
from a dotenv file.
Verify
Check addresses
Open the environment and confirm key names, paths and versions. A sync path prefix or a typed path puts a key where your code may not look.
Remove the old copies
Delete the values at the source. Rotate anything you pasted into a chat: importing does not remove it from chat history.
Stream the audit log
On Enterprise, or with the streaming add-on, we deliver every audit entry to your HTTPS endpoint, Datadog, Splunk or S3. Setup, verification and retries.
Leave penv
Pull each environment into plain value files, decrypt any encrypted values, remove penv's files and credential, then delete your workspace.