Share a .env file with your team
Commit your .env.schema, push your values to Penv Cloud, and invite teammates in the console. Each teammate runs the app with penv run.
| Item | Stored in | Readable by |
|---|---|---|
| Key names and types | .env.schema, committed | Anyone with repository access |
| Values | Penv Cloud: we encrypt them under your workspace's data key | Your workspace members, per their roles |
| A running app's values | The child process of penv run | That process |
Set up the project
Run once, from the machine that holds your current .env:
penv initpenv init writes .env.schema beside .env and adds .env, .env.* and !.env.schema to .gitignore. See from a .env file.
penv pushpenv push sends the values in .env to us; we encrypt and store them. Once we confirm the write, penv deletes .env. .env.local stays on your machine. With no @penv header, push creates the project and writes the header.
git add .env.schema && git commit -m "Declare the environment"Add a teammate
Invite your teammate in the console: members and invites. Seat pricing: billing and plans.
git clone <repo> && cd <repo>
penv login
penv run -- pnpm devpenv login signs your teammate in. penv run then fetches development from us, validates it against the schema and starts the app. penv writes no value file.
For tools that need a file, penv pull writes one from your cloud values.
Changes
| Change | Command or page |
|---|---|
| New value for a key | penv set; your teammates receive it on their next run. See rotate a value |
| A teammate leaves | Remove the member. See offboard a member |
Adopt an existing app
Turn your .env into a committed .env.schema and .penv/config.toml, generate typed access, write agent guards, then push the values to us.
Keep .env out of git
Commit .env.schema instead of .env, let penv check and penv scan catch a tracked secret, and recover when a .env is already in your git history.