envmaster CLI

A thin wrapper over the SDK: same client-side decryption, same guarantees.

envmaster login    --url <url> --client-id <id> --client-secret <secret>
envmaster export   --project <slug> --env <slug> [--file out.env]
envmaster run      --project <slug> --env <slug> [--mask] -- <cmd...>
envmaster validate --project <slug> --env <slug> [--schema env.schema.yml]
envmaster import   [file] --project <slug> --env <slug> [--dry-run]

Where credentials come from

In descending priority: flags → ENVMASTER_* variables → ~/.envmaster/config.json (written by envmaster login, mode 0600). The config holds machine credentials, not entry values: secrets never touch the disk at any step.

run instead of export

export writes a file; run passes values to a child process — and leaves nothing on disk:

envmaster run --project billing-api --env production --mask -- ./deploy.sh

With --mask, the child process output is filtered line by line, and the exit code is proxied.

import for migration

ENVMASTER_TOKEN=<token from the cabinet> \
  envmaster import .env --project billing-api --env production --dry-run

Keys matching *PASSWORD*, *TOKEN*, *SECRET*, *KEY* become secrets, the rest become variables; --all-secrets turns everything into secrets. Existing keys are skipped unless --overwrite is passed.

The command writes, so it requires a user token rather than machine credentials — those are read-only by design.