Share a .env file with your team
Stop pasting .env files into chat. Commit the schema, push the values once, and every teammate gets them with one command.
The usual way to share a .env file is to paste it into a chat message. It works, and then it
keeps working long after it should: the message is still there when the person leaves, when the
key is rotated, and when the chat export lands in someone's inbox.
This page replaces the paste with four commands. After them, the file is not shared at all. The schema is committed, the values live in one place, and each teammate pulls their own copy.
What gets shared, and what does not
| Thing | Where it goes | Who sees it |
|---|---|---|
| Key names and types | .env.schema, committed to git | Everyone who can read the repo |
| Values | Penv Cloud, encrypted | People you add to the workspace |
| A running app's environment | The child process only | Nobody else, not even the shell |
Think of a supermarket receipt. The schema is the list of items; the values are the card number. You can hand the list to anyone. The card number goes nowhere.
Once, by whoever has the file
Turn the file into a schema. Run this in the directory that holds .env:
penv initIt writes .env.schema beside the file and adds .env to .gitignore. No secret value is
copied into the schema. What init reads lists exactly what it
keeps out.
Move the values to the cloud.
penv pushThe values are encrypted and stored under your workspace, and the local .env is deleted once the
write succeeds. The file is now gone from the one machine it was on.
Commit the schema.
git add .env.schema && git commit -m "Declare the environment"This is the only file the repository needs. It says what the app expects, not what the values are.
Every teammate, from then on
Add them in the console. Members and their roles live in the workspace, not in a file. Up to three people are free.
They clone and run.
git clone <your repo> && cd <your repo>
penv run -- pnpm devThe first run asks them to sign in. After that, penv run fetches the values for the
development environment, checks them against the schema, and starts the app with them in its
environment. Nothing is written to disk.
If someone wants a file anyway, penv pull writes a fresh .env from the cloud. It is a view
they can regenerate, not a copy they have to keep.
When something changes
A rotated key is one penv set in the cloud. Every teammate picks it up on their next run, and
nobody has to be sent a new file. When a person leaves, remove them from the workspace and their
access stops with them; there is no message to hunt down. The steps for both are in
Rotate a value and
Offboard a member.