Commands

The Enkryptify CLI (ek) provides commands to authenticate, configure and run your applications with secrets injected as environment variables.

Usage

ek [command]

Global Flags

-h, --help: help for ek
-v, --version: get the current version of the CLI

Authenticate with Enkryptify to access your secrets.This opens a web browser to complete the OAuth flow. After successful authentication, credentials are stored securely in your system keyring.

ek login

Options:

-f, --force: force re-authentication even if already logged in

ek login --force

logout

Log out of Enkryptify and revoke your CLI token.This revokes the active CLI token on the server and clears local credentials from the system keyring. If the server is unreachable, local credentials are still cleared.

ek logout

whoami

Show the currently authenticated user.Displays the name and email of the user associated with the current session. If not logged in or the session has expired, you will be prompted to run ek login.

ek whoami

configure

Link the current git repository to an Enkryptify workspace, project and environment.The configuration is saved to ~/.enkryptify/config.json and associated with the current directory path.

ek configure
# OR
ek setup

To share the link with your whole team through Git instead, commit a project configuration file.

import

Import secrets from a .env file into Enkryptify. This is the upload half of every import workflow: pull your environment into a .env file, then upload it with one command.

ek import [file]

Arguments:

file (optional): path to any dotenv file. Defaults to .env in the current directory. Pass another name such as .env.production or config/.env.staging to import a different file.

What it does:

Reads and parses the file. It understands KEY=value lines, an optional export prefix, # comments and quoted values (single, double and multi-line).
Prompts you to choose the target workspace, project and environment. When only one option exists it is selected automatically. You can also create a new project or environment inline.
Uploads the parsed secrets to the selected environment.
Asks whether to delete the source file once the import succeeds, so no plaintext copy is left behind.

You must be logged in with ek login first.

ek import                 # Import ./.env (the default)
ek import .env.production  # Import a specific file
ek import config/.env      # Import a file in another directory

Pair ek import with your provider’s CLI to move secrets from Vercel, 1Password or AWS Secrets Manager. See Import secrets.

run

Run a command with secrets from Enkryptify injected as environment variables.This fetches secrets for your configured workspace, project and environment, then executes the provided command with those secrets available as env vars.Arguments:

cmd: command and arguments to run

Options:

-e, --env <environmentName>: environment name to use (overrides default from config)
-p, --project <projectName>: project name to use (overrides default from config; requires --env)
--skip-cache: skip local cache and always fetch fresh secrets from the API
--offline: use cached secrets without making an API call

--skip-cache and --offline are mutually exclusive.

Note: Use -- to separate ek run from the command you want to execute.

ek run -- <command>

Examples:

ek run -- npm start                            # Run npm start with secrets
ek run -- pnpm run dev                         # Run pnpm dev with secrets
ek run -- python app.py                        # Run Python app with secrets
ek run -- docker-compose up                    # Run docker-compose with secrets
ek run -e staging -- npm start                 # Override environment
ek run -p backend -e production -- npm start   # Override project and environment
ek run --skip-cache -- npm start               # Force fresh secrets
ek run --offline -- npm start                  # Use cached secrets only

run-file

Replace all ${VARIABLES} in a file with the corresponding secrets from Enkryptify.

ek run-file --file <file>

Options:

-f, --file <path>: path to the file to process (required)
-e, --env <environmentName>: environment name to use (overrides default from config)
--skip-cache: skip local cache and always fetch fresh secrets from the API
--offline: use cached secrets without making an API call

--skip-cache and --offline are mutually exclusive.

Usage:

sam deploy --config-file <(ek run-file --file samconfig.toml)
node index.js --file <(ek run-file --file data.json)

Examples of files to replace variables in:

[default]
region = "${AWS_REGION}"
stack_name = "${STACK_NAME}"
s3_bucket = "${AWS_S3_BUCKET}"
s3_prefix = "${AWS_S3_PREFIX}"
s3_key = "${AWS_ACCESS_KEY_ID}"
s3_secret = "${AWS_SECRET_ACCESS_KEY}"
s3_session_token = "${AWS_SESSION_TOKEN}"
s3_region = "${AWS_REGION}"

{
  "databaseUrl": "${DATABASE_URL}",
  "sessionToken": "${SESSION_TOKEN}"
}

sdk

Run a command with a read-only Enkryptify SDK token injected as the ENKRYPTIFY_TOKEN environment variable.The token is scoped to the configured workspace, project and environment and is valid for 8 hours. This is useful for running applications that use the Enkryptify SDK to fetch secrets at runtime instead of having all secrets injected as environment variables.Note: Use -- to separate ek sdk from the command you want to execute.

ek sdk -- <command>

Examples:

ek sdk -- npm start       # Run npm start with SDK token
ek sdk -- python app.py   # Run Python app with SDK token

upgrade

Upgrade the Enkryptify CLI to the latest version. The command auto-detects the original install method (Homebrew, Scoop or binary) and upgrades accordingly.

ek upgrade

Options:

-f, --force: force upgrade even if already on the latest version

ek upgrade --force

Project Configuration File

Instead of linking a directory with ek configure, you can commit a .enkryptify.json file to your repository. It tells the CLI which workspace, project and environment to use, so anyone who clones the repository can run ek run right away after logging in, without going through ek setup.

.enkryptify.json

{
  "workspace": "my-workspace",
  "project": "backend",
  "environment": "10af8e49-453e-477b-b181-12b7ad95c8f2"
}

All three fields are required and must be non-empty strings. Each field accepts a slug or an id. The file contains only these references, never secret values, so it is safe to commit.

Lookup order

When a command such as ek run needs a project, the CLI walks from the current directory up to the repository root. At each directory it looks for a .enkryptify.json file first, then for a setup saved by ek configure. A setup linked to the whole Git repository is checked last, at the repository root. In practice this means:

A committed .enkryptify.json takes precedence over setups saved with ek configure.
The nearest file wins. In a monorepo each app can carry its own file, so apps/api and apps/web can point at different projects.

The file pins the environment for everyone who clones the repository. To use a different environment for a single command, override it with ek run -e <environment> -- <command>.

Secret Management

The ek secret commands are deprecated and may be removed in a future release. Manage secrets through the Enkryptify dashboard instead.

All secret operations are subcommands of ek secret.

ek secret [subcommand]

secret create (deprecated)

Create a new secret in the current environment.

ek secret create <name> [value]

Arguments:

name: secret key (A-Z, a-z, 0-9, underscore, hyphen)
value: secret value (use quotes for spaces or special characters)

ek secret create DATABASE_URL "postgresql://app:app@localhost:5432/enkryptify"

Expected result: the DATABASE_URL secret is created in the current environment.

secret update (deprecated)

Update a secret in the current environment.

ek secret update <name>

Arguments:

name: secret key to update

Options:

--ispersonal: make the secret personal (Enkryptify provider only)

ek secret update DATABASE_URL

Expected result: the DATABASE_URL secret is updated in the current environment.

secret delete (deprecated)

Delete a secret from the current environment.

ek secret delete <name>

Arguments:

name: secret key to delete

ek secret delete DATABASE_URL

Expected result: the DATABASE_URL secret is removed from the current environment.

secret list (deprecated)

List secrets in the current environment.

ek secret list [options]

Options:

-s, --show: show secret values (defaults to masked)

ek secret list --show

Expected result: a table of secrets with values visible.

Secret Caching

Secrets fetched by ek run and ek run-file are cached in the system keyring with a 10-second TTL. This avoids redundant API calls when running commands in quick succession. Three caching modes are available:

Normal (default): fetches from cache if valid, otherwise calls the API
Skip cache (--skip-cache): always fetches fresh secrets from the API
Offline (--offline): uses cached secrets without any API call; fails if no cache exists

If an API call fails in normal mode, the CLI falls back to cached secrets when available.

​Usage

​Global Flags

​Commands

​Project Configuration File

​Lookup order

​Secret Management

​Secret Caching

Usage

Global Flags

Commands

Project Configuration File

Lookup order

Secret Management

Secret Caching