Your first workspace
Create a project and an environment, set a value, approve a terminal, answer a reveal, and invite your team in the Penv Cloud console.
Your workspace holds projects, a project holds environments, and an environment holds keys.
Create a project and an environment
penv pushWith no @penv= header in .env.schema, penv push prints the project it will create, has us create it with a development environment, and writes our slug into the header. We derive slugs from names and refuse an ambiguous address rather than guess.
Set a value
penv set STRIPE_SECRET_KEYpenv set prompts without echoing the value. You can pipe the value instead; either way it stays out of your shell history.
Sidebar
You see a row only when you hold its permission, and we check the same permission on the page behind it. With no permission anywhere, we send you to /no-access. Row-by-row permissions: the console.
Approve a terminal
penv login prints an eight-character code, XXXX-XXXX, valid for ten minutes. Enter it on /device; we show the name the terminal gave itself, its source address and when it asked, and you choose the workspace it may reach before you choose Approve or Deny. With an authenticator enrolled, approving asks you to step up; denying never does.
Approve only a code shown in your own terminal. Check the address and time against the sign-in you started. We never send you a code to approve; a code that arrives in a message or a link is someone else's sign-in.
Answer a reveal
A coding agent running penv reveal KEY in a session penv detects receives an approval id and exit code 4, never the value.
If you hold secret:reveal on that environment, open /approvals/<id> within ten minutes and approve or deny; with an authenticator enrolled, we ask you to step up first. We record your answer in the audit log (approvals).
Under a harness where penv guard installs penv hook (Claude Code, Cursor, Windsurf, Cline, Gemini CLI), the hook lets penv reveal through to this approval from 1.0.0-beta.4. In 1.0.0-beta.3 it refuses penv reveal outright, so no approval is created.
Invite members
Add people under Settings, Members; Roles sets what each may reach (members and invites). The Free plan includes three seats. We never bill a seat for a machine (plans).