Stop sharing .env files
on Slack
One encrypted source of truth for your team's secrets, pulled into any server, cluster, or CI pipeline with one command — with access control and a full audit log.
# Install curl -fsSL https://get.snapenv.io/install.sh | sh # Authenticate snapenv login --token snp_live_xxxxxxxxxxxx # Pull secrets to .env snapenv pull --env prod ✓ 14 variables written to .env
Everything you need, nothing you don't
Built for teams that take secrets seriously — from a single server to a multi-cluster Kubernetes setup.
Encrypted at rest
Every variable is encrypted with AES-256-GCM before it touches the database. Each project has a unique derived key — a breach of one project exposes nothing else.
Details
- AES-256-GCM on every value
- Per-project derived keys (HKDF-SHA256)
- Unique IV per write
- Decryption is server-side only
Access tokens & 2FA
Lock down exactly who and what can authenticate — scoped tokens for machines, TOTP 2FA for humans.
Details
- Tokens scoped to one project or environment
- Read-only or read + write, revoked instantly
- TOTP 2FA with single-use backup codes
- No phone number ever collected
Audit log
Append-only record of every pull, push, change, and team action. Filter by project, environment, or actor. Required for SOC2 and compliance reviews.
Details
- Every pull, push, change, and team action
- Append-only — nothing can be edited or deleted
- Filter by project, environment, or actor
- SOC2 and compliance-review ready
Team access control
Workspace roles, project roles, and per-environment permissions. Developers can write to staging but only read production. Every action is in the audit log.
Details
- Workspace + project role layers
- Per-environment read/write overrides
- Protected environments by default
- Least-privilege for every new member
Version control & rollback
Broke something? Roll back to any previous value with one click — nothing is ever silently overwritten.
Details
- Full change history per variable
- One-click rollback to any version
- Compare versions and environments
- Change attribution — who, and when
Expiry & rotation reminders
Set expiry dates on sensitive credentials, or let SnapEnv flag secrets that just haven't been touched in a while — even without one.
Details
- Expiry dates with email reminders
- Automatic staleness badges at 90/180 days
- Filter a project down to what needs attention
- Never miss a rotation again
AI-agent-safe secret injection
Give Claude Code, Cursor, or a CI job a command to run — never the secret itself. Values go straight into the process and get scrubbed from anything it prints.
Details
- Injects into the subprocess env — no .env on disk
- {{VAR}} placeholder substitution in argv
- Live output scrubbing catches accidental leaks
- Works with any CI, PaaS, or coding agent
$ snapenv run --all -- node server.js ✓ 8 variables injected, 0 written to disk
Bulk import & export
Import hundreds of variables in one paste. Export to .env or JSON anytime — no lock-in, your data is always yours to take with you.
Details
- .env, CSV, and JSON import/export
- Bulk edit variables across a selection
- Copy variables between environments
- Bulk delete with a single confirmation
# Export to .env format DATABASE_URL=postgres://... API_KEY=sk_live_...
Variable references
Reference one variable from another with ${VAR} syntax instead of duplicating values. Change it once, and everything that points to it updates automatically.
Details
- ${VAR} and ${VAR:-fallback} syntax
- Resolved dynamically at read time — never stored
- Chained references, unlimited depth
- Circular references caught before they ship
APP_URL=https://app.example.com
API_URL=${APP_URL}/apiWebhooks & Slack alerts
Get a readable Slack message the moment a variable changes, or trigger deploys with signed HTTP webhooks. Per-event filtering and a full delivery log either way.
Details
- One-click Slack notifications — no signing setup
- HMAC-SHA256 signed payloads for custom webhooks
- Per-event filtering, including bulk changes
- Delivery log with status codes
Direct feedback & support
Request a feature, report a bug, or book a call with the team — right from the dashboard. No ticket system, no separate login.
Details
- Feature requests, bug reports, and contact — one place
- Book a meeting directly with our team
- Every submission routed straight to us
- No third-party support tool required
Pull secrets wherever they run
Every method authenticates with an access token. Scoped by environment, project, and permission level.
Pull to any server or shell in seconds.
$ snapenv pull --env prod ✓ 14 variables written to .env
Install a skill for Claude Code and other agents — CLI, operator, Helm, and API in one package.
curl -fsSL https://get.snapenv.io/skill.sh | sh
Auto-sync into native Kubernetes Secrets. No init containers.
kubectl apply -f https://get.snapenv.io/operator/install.yaml
Inject secrets into any CI step — no third-party action needed.
- run: |
curl -fsSL https://get.snapenv.io/install.sh | sh
snapenv pull --env prodResolve secrets at container start, not at build time.
CMD snapenv pull --env prod && node server.js
Pull into the build — only your token touches Vercel env vars.
"vercel-build": "snapenv pull --env prod --output .env.production.local && next build"
A long-running process — inject secrets directly, no .env file.
snapenv run --all -- node dist/server.js
Wrap the Start Command instead of Render’s Environment tab.
snapenv run --all -- node dist/server.js
Self-hosted PaaS — the same snapenv run pattern works on both, unchanged.
snapenv run --all -- node dist/server.js
Zero plaintext in the database
Every variable value is encrypted before any write hits PostgreSQL. The encryption key is derived per-project using HKDF-SHA256 from a master key that lives only on the API server — never in the database, never in the CLI.
Even if someone exfiltrated the entire database, they would get AES-256-GCM ciphertext with no way to derive the keys.
// Key derived per project, never stored key = HKDF-SHA256( MASTER_KEY, salt=projectID, info="snapenv-variable-key", ) // Unique IV per write ciphertext, iv = AES-256-GCM(key, plaintext) // Only ciphertext + iv stored in DB INSERT INTO variables (value_enc, iv, ...)
Simple, transparent pricing
Start free. Upgrade when you need more. No surprise charges.
- 3 projects
- 3 team members
- 3 environments per project
- CLI + Kubernetes operator
- Variable history
- Audit log — 7-day retention
- 10 projects
- Up to 10 members
- 5 environments per project
- CLI + Kubernetes operator
- Variable history
- Audit log — 90-day retention
- Webhooks
- Expiry reminders & staleness alerts
- Priority support
- Unlimited projects
- Unlimited members
- Unlimited environments
- CLI + Kubernetes operator
- Variable history
- Audit log — unlimited retention
- Webhooks
- Expiry reminders & staleness alerts
- Priority support
- SSO (coming soon)
- SLA
- Self-hosted — Docker Compose or Kubernetes
- Unlimited projects, members, environments
- Single sign-on (OIDC)
- Your own encryption keys
- Direct support from our team
Frequently asked questions
What is SnapEnv?
SnapEnv is a secure environment variable manager for dev teams and production servers. It stores secrets encrypted with AES-256-GCM, delivers them anywhere via a CLI, Kubernetes operator, GitHub Actions, or Docker, and keeps an append-only audit log of every access.
How does SnapEnv keep secrets secure?
Every value is encrypted with AES-256-GCM before it is written to the database, using a per-project key derived via HKDF-SHA256 from a server-side master key that is never stored in the database or sent to the CLI. Decryption is server-side only and the audit log is append-only.
How do I get secrets into my app, CI, or Kubernetes?
Use the snapenv CLI to pull variables into a .env file or inject them into a command, the GitHub Actions integration for CI, or the Kubernetes operator to sync them into native Secret objects and auto-restart workloads on change.
How is SnapEnv different from Doppler, Vault, or AWS Secrets Manager?
SnapEnv is flat-priced, focused on a fast CLI-first workflow for environment variables. Doppler is a managed, per-seat cloud platform; HashiCorp Vault is a powerful but operationally heavy secrets engine; AWS Secrets Manager is AWS-native and priced per secret. See the detailed comparisons at /vs.
Is there a free plan?
Yes. The Free plan includes 3 projects, 3 team members, and 3 environments per project, with the full CLI and Kubernetes operator. Paid plans (Pro at $9/month, Team at $29/month) raise the limits.
Comparing tools? See SnapEnv vs Doppler, Vault, and AWS Secrets Manager →