AI agents - Enkryptify Documentation

AI coding agents (Claude Code, Codex, Cursor, …) run your app with whatever command they find: npm run dev, pytest, go run .. By default they expect a local .env file and have no idea your secrets live in Enkryptify, so they either fail with missing env vars or recreate a .env you don’t want. There are two ways to make agents pick up secrets through the Enkryptify CLI automatically. Use either one, or both together.

Both approaches require the CLI to be configured once. Run ek login and then ek setup in your project (see the Quickstart). After that, every command works without further setup.

Approach 1: Bake `ek run` into your commands

Wrap the commands an agent naturally runs so secrets are injected automatically. The agent keeps calling npm run dev or make test and gets your Enkryptify secrets without knowing Enkryptify exists.

Node.js
Python
Go
Ruby
Other

Wrap your scripts in package.json with ek run --:

package.json

{
  "scripts": {
    "dev": "ek run -- next dev",
    "start": "ek run -- node server.js",
    "test": "ek run -- vitest",
    "migrate": "ek run -- drizzle-kit push"
  }
}

Now npm run dev, pnpm dev and yarn dev all run with secrets injected, with no change needed from the agent.

Python has no standard script runner, so use a Makefile (or a justfile) as the entry point the agent calls:

Makefile

dev:
	ek run -- python manage.py runserver

test:
	ek run -- pytest

migrate:
	ek run -- python manage.py migrate

Agents then run make dev or make test with secrets injected.

Makefile

run:
	ek run -- go run .

test:
	ek run -- go test ./...

Agents then run make run or make test with secrets injected.

Makefile

dev:
	ek run -- rails server

test:
	ek run -- bundle exec rspec

Agents then run make dev or make test with secrets injected.

A Makefile works for any stack and gives agents a consistent entry point regardless of language:

Makefile

dev:
	ek run -- <your start command>

test:
	ek run -- <your test command>

The same idea applies to a justfile, Taskfile.yml, shell scripts or any task runner: just prefix the underlying command with ek run --.

This is the most reliable approach because it doesn’t depend on the agent reading or following instructions. The secrets are wired into the command itself.

Approach 2: Tell your agent to use `ek run`

Add a short instruction to your agent’s rules file so it prefixes commands with ek run -- and never touches .env files. Pick your agent below for the correct file location, then copy the prompt into it.

Add the following to CLAUDE.md in your project root (create it if it doesn’t exist):

CLAUDE.md

## Secrets (Enkryptify)

This project's secrets and environment variables are managed by Enkryptify
(https://enkryptify.com), not by `.env` files.

- Never create, read, edit or commit `.env` files, and never hardcode secret values.
- To run any command that needs environment variables (dev server, tests, scripts,
  migrations), prefix it with `ek run --`. For example:
    - `npm run dev`  ->  `ek run -- npm run dev`
    - `pytest`       ->  `ek run -- pytest`
    - `go run .`     ->  `ek run -- go run .`
- `ek run` fetches secrets from Enkryptify and injects them as environment variables
  for that single command only.
- If `ek` is not set up yet, run `ek login` once, then `ek setup` inside the project.

Add the following to AGENTS.md in your project root (create it if it doesn’t exist):

AGENTS.md

## Secrets (Enkryptify)

This project's secrets and environment variables are managed by Enkryptify
(https://enkryptify.com), not by `.env` files.

- Never create, read, edit or commit `.env` files, and never hardcode secret values.
- To run any command that needs environment variables (dev server, tests, scripts,
  migrations), prefix it with `ek run --`. For example:
    - `npm run dev`  ->  `ek run -- npm run dev`
    - `pytest`       ->  `ek run -- pytest`
    - `go run .`     ->  `ek run -- go run .`
- `ek run` fetches secrets from Enkryptify and injects them as environment variables
  for that single command only.
- If `ek` is not set up yet, run `ek login` once, then `ek setup` inside the project.

Add the following to .cursor/rules/enkryptify.mdc (or the legacy .cursorrules file):

.cursor/rules/enkryptify.mdc

---
description: Use the Enkryptify CLI for secrets
alwaysApply: true
---

This project's secrets and environment variables are managed by Enkryptify
(https://enkryptify.com), not by `.env` files.

- Never create, read, edit or commit `.env` files, and never hardcode secret values.
- To run any command that needs environment variables (dev server, tests, scripts,
  migrations), prefix it with `ek run --`. For example:
    - `npm run dev`  ->  `ek run -- npm run dev`
    - `pytest`       ->  `ek run -- pytest`
    - `go run .`     ->  `ek run -- go run .`
- `ek run` fetches secrets from Enkryptify and injects them as environment variables
  for that single command only.
- If `ek` is not set up yet, run `ek login` once, then `ek setup` inside the project.

Add the following to .github/copilot-instructions.md (create it if it doesn’t exist):

.github/copilot-instructions.md

## Secrets (Enkryptify)

This project's secrets and environment variables are managed by Enkryptify
(https://enkryptify.com), not by `.env` files.

- Never create, read, edit or commit `.env` files, and never hardcode secret values.
- To run any command that needs environment variables (dev server, tests, scripts,
  migrations), prefix it with `ek run --`. For example:
    - `npm run dev`  ->  `ek run -- npm run dev`
    - `pytest`       ->  `ek run -- pytest`
    - `go run .`     ->  `ek run -- go run .`
- `ek run` fetches secrets from Enkryptify and injects them as environment variables
  for that single command only.
- If `ek` is not set up yet, run `ek login` once, then `ek setup` inside the project.

Add the following to .windsurf/rules/enkryptify.md (or the legacy .windsurfrules file):

.windsurf/rules/enkryptify.md

## Secrets (Enkryptify)

This project's secrets and environment variables are managed by Enkryptify
(https://enkryptify.com), not by `.env` files.

- Never create, read, edit or commit `.env` files, and never hardcode secret values.
- To run any command that needs environment variables (dev server, tests, scripts,
  migrations), prefix it with `ek run --`. For example:
    - `npm run dev`  ->  `ek run -- npm run dev`
    - `pytest`       ->  `ek run -- pytest`
    - `go run .`     ->  `ek run -- go run .`
- `ek run` fetches secrets from Enkryptify and injects them as environment variables
  for that single command only.
- If `ek` is not set up yet, run `ek login` once, then `ek setup` inside the project.

Add the following to GEMINI.md in your project root (create it if it doesn’t exist):

GEMINI.md

## Secrets (Enkryptify)

This project's secrets and environment variables are managed by Enkryptify
(https://enkryptify.com), not by `.env` files.

- Never create, read, edit or commit `.env` files, and never hardcode secret values.
- To run any command that needs environment variables (dev server, tests, scripts,
  migrations), prefix it with `ek run --`. For example:
    - `npm run dev`  ->  `ek run -- npm run dev`
    - `pytest`       ->  `ek run -- pytest`
    - `go run .`     ->  `ek run -- go run .`
- `ek run` fetches secrets from Enkryptify and injects them as environment variables
  for that single command only.
- If `ek` is not set up yet, run `ek login` once, then `ek setup` inside the project.

Most agents read an AGENTS.md file in your project root, which is becoming the shared standard across tools. Add the prompt there:

AGENTS.md

## Secrets (Enkryptify)

This project's secrets and environment variables are managed by Enkryptify
(https://enkryptify.com), not by `.env` files.

- Never create, read, edit or commit `.env` files, and never hardcode secret values.
- To run any command that needs environment variables (dev server, tests, scripts,
  migrations), prefix it with `ek run --`. For example:
    - `npm run dev`  ->  `ek run -- npm run dev`
    - `pytest`       ->  `ek run -- pytest`
    - `go run .`     ->  `ek run -- go run .`
- `ek run` fetches secrets from Enkryptify and injects them as environment variables
  for that single command only.
- If `ek` is not set up yet, run `ek login` once, then `ek setup` inside the project.

Instructions are advisory. For a guarantee, combine this with Approach 1 so secrets are wired into the commands themselves.

Next steps

Learn what ek run does in the Commands reference
See per-language run examples in the Developer onboarding guide

​Approach 1: Bake ek run into your commands

​Approach 2: Tell your agent to use ek run

​Next steps

Approach 1: Bake `ek run` into your commands

Approach 2: Tell your agent to use `ek run`

Next steps