Sync your .env files and secrets anywhere. One command.
dotvault encrypts your .env files, config files (.npmrc, kubeconfig, certs) and structured secrets server-side (DynamoDB + KMS), then lets any authorized teammate pull them to their laptop or CI runner with a single dotvault pull. No AWS account required.
What dotvault takes off your plate
AWS accounts required
command to sync (dotvault pull)
official SDKs (Go, Python)
built-in roles
What you can do
Everything you need to distribute secrets safely, in one CLI.
Pull with one command
dotvault pull writes every declared file to disk. Hand-written lines outside the managed markers are always preserved.
Run without writing files
dotvault run -- npm run dev injects secrets straight into the child process environment. Ideal for local dev.
Version history and rollback
dotvault versions shows the full history of a key; dotvault rollback --to <version> restores any prior value.
Sync any file, not just .env
.npmrc, kubeconfig, certs — sync any file as-is with dotvault push, no extra configuration.
Built for teams and organizations
From solo developers to organizations running many projects.
- 4 roles, clear permissions
Personal Owner, Org Admin, Org Member, and Platform Admin — each with clearly scoped permissions.
- Service tokens for CI/CD
Mint an est_... service token, store it as DOTVAULT_TOKEN in your CI secrets, and pull production secrets with no interactive login.
- Org-wide shared keys
Credentials shared across projects (Cloudflare, Sentry, ...) live once in the org's global key pool — each project explicitly binds only what it needs.
- Audit log
Track who changed which value, and when, from the Audit Log.
- Platform-level administration
The platform_admin role covers plan catalog management, cross-org visibility, org suspension, and SCIM.
- Tokens stay in your OS keychain
Auth tokens are stored in macOS Keychain, Linux libsecret, or Windows Credential Manager — never in a plain file.
Why teams switch to dotvault
Stop pasting .env into chat or wikis
Values are encrypted server-side. Only permitted members can pull them — no more secrets flying around in copy-paste.
Onboarding takes two lines
A new developer runs dotvault login && dotvault pull and every environment variable they need is there.
Catch secrets before they're committed
Run dotvault scan as a pre-commit hook to catch secrets before they land in a commit — fully offline.
Roll back with confidence
Every key is versioned, so a mistake is one dotvault rollback away from being fixed.
Built for these moments
Solo developers
Run dotvault init, login, and pull to keep .env in sync across every machine you code on.
Development teams
Onboarding a new teammate is login + pull — no more sending .env files over Slack.
CI/CD pipelines
Store a service token as DOTVAULT_TOKEN in your CI secrets, then dotvault pull --env production for production secrets.
Organizations running multiple products
Shared credentials like a Cloudflare token live in the global key pool — only the projects that need them bind in.
Teams syncing more than .env
.npmrc, kubeconfig, certificates — dotvault push brings them into the same sync flow.
Stop pasting .env files into Slack. Secrets shouldn't be copied around — they should be pulled by whoever's authorized. That's dotvault.
Frequently asked questions
No. dotvault users don't need an AWS account. Authentication is Cognito email + password, and storage/encryption (DynamoDB + KMS) is handled entirely by dotvault's infrastructure.
Stop sharing .env files. Start pulling them.
Get started free