apivault env
The apivault env command writes an environment's secrets to a dotenv file, for tools that only read configuration from a file. When a tool can take environment variables instead, apivault run avoids writing secrets to disk at all.
Usage
apivault env export --env Production
Decrypts the Production keys and merges them into .env.
apivault env restore
Puts back dotenv files that apivault run moved aside.
Subcommands
env export
Decrypts the keys for an environment and writes them to a local file, .env by default. Existing variables in the file are preserved — keys from the vault are updated in place and new ones appended. --force replaces the file instead.
# Export to .env (merges with existing variables) apivault env export --env Production # Export to a custom file apivault env export --env Staging -o .env.local # Replace the file entirely instead of merging apivault env export --env Production --force
Without --env, the environment comes from a service token's pin or the run.env config value.
.gitignore before you export.env restore
apivault run renames local dotenv files to *.apivault-run-hidden while a command runs and restores them on exit. If that was interrupted, this puts them back.
# Restore in the current directory apivault env restore # Restore in a specific directory apivault env restore -C /path/to/project
Unique options
| Option | Subcommands | Description |
|---|---|---|
--env <environment> | export | Environment to export (or config run.env) |
-o, --output <file> | export | Output file (default .env) |
-f, --force | export | Replace the file instead of merging |
--vault-key <vault-key> | export | Custom vault key, for projects in custom encryption mode |
-C, --directory <dir> | restore | Project directory to restore in (default: current directory) |
Global options
apivault env also accepts the global options, such as --json and --project.