config.toml

Every section of .penv/config.toml: grammar version, local encryption, public prefixes, public lists for url, hash and json, and host pins.

penv init writes .penv/config.toml with a comment above each setting. A section penv does not know survives a write.

.penv/config.toml

[schema]
version = 1

[run]
preload = true

[local]
encrypt = false

[public]
prefixes = []

[url]
public = ["scheme", "host", "port", "origin"]

[hash]
public = []

# One section per key whose json() reads may be shown unmasked:
# [json.GCP_SA_JSON]
# public = ["client_email", "project_id"]

You add [json.KEY] yourself, and penv check --pin-hosts writes [hosts]. The explanatory comments init writes are omitted above.

Section	Key	Values
`[schema]`	`version`	The grammar version.
`[run]`	`preload`	`true` loads penv's masking into the Node, Bun, Deno and Python processes `penv run` starts, so the app's own logs and responses are masked; `false` masks only `penv run`'s output.
`[local]`	`encrypt`	`false` writes plain text; `true` writes `enc:v1:` values keyed in your keychain (`penv encrypt`). Applies to `penv set`, `penv pull` and `random()`.
`[public]`	`prefixes`	Prefixes that ship a key to the browser, beyond `NEXT_PUBLIC_`, `VITE_` and the rest.
`[url]`	`public`	URL parts a `url()` read shows unmasked: `scheme`, `host`, `port`, `origin`, `path`, `user`, `query.NAME`. `password` never is.
`[hash]`	`public`	Keys whose `hash()` result is shown. Each must hold a `hash()` call.
`[json.KEY]`	`public`	Added by you. Paths a `json()` read of `KEY` shows unmasked. One section per key.
`[hosts]`	`KEY = [...]`	Pins a computed `@hosts`. Written only by `penv check --pin-hosts`.
`[providers.<slug>]`	`url`	The API root (`@penv`).
`[targets.<name>]`	`options`	Where `penv gen` writes and the options it uses.
`[rotation]`	`KEY = "date"`	The day a key was last written in local mode, for `@rotate`. penv writes it.

Public lists

Every list is named public; query.sslmode shares the URL list.
A public read declassifies only a stored value, never one an expression built.
penv check fails on a [url] public entry that is password, not a URL part, or not a string, a [json.KEY] section without a list of read paths, and a [hash] public key whose value is not a whole hash() call. It notes each [hash] key.
Add "path" to [url] public to show a URL path; it is sensitive by default.

hosts

penv check --pin-hosts

Pairs with a computed @hosts the way [rotation] pairs with @rotate. check and sealed runs refuse a key whose hosts differ from its pin, naming the key and both lists. The command keeps comments and order, prints only changed hosts, and is the only writer of [hosts].

Public lists

hosts

On this page