Core Commands

These commands handle the basic workflow of syncing environment variables between EnvManager and your local .env files.

pull

Download variables from EnvManager to a local file.

envmanager pull [options]

Options:

Examples:

# Pull from configured project/environment
envmanager pull

# Pull specific environment
envmanager pull --environment production

# Pull to custom file
envmanager pull --output .env.local

# Pull without secret values
envmanager pull --no-secrets

# Pull as Docker Compose YAML
envmanager pull --format docker-compose -o docker-compose.env.yml

# Pull as Kubernetes Secret
envmanager pull --format k8s-secret --k8s-name my-app --k8s-namespace production -o secrets.yaml

Output:

Pulled 12 variables to .env (dotenv)
  8 plain, 4 secrets

For details on all supported export formats, see Export Formats.

push

Upload a local .env file to EnvManager. Existing variables are updated in place, new ones are added; nothing is deleted. The push is all-or-nothing: if anything fails, no variable is changed.

envmanager push [options]

Options:

Examples:

# Push from .env
envmanager push

# Preview first — shows target project, environment and service
envmanager push --dry-run

# Mark specific variables as secrets
envmanager push --secrets "DATABASE_URL,API_SECRET"

# Patterns: * matches anything, ? matches one character
envmanager push --secrets "STRIPE_*,*_SECRET,*_TOKEN"

# Push a different file to production
envmanager push --input .env.production --environment production

# Push to a service, creating it on the first run
envmanager push --service worker --create

How secrets are decided:

• Keys matching --secrets become secrets. Matching is case-sensitive; * and ? are the only wildcards.
• Keys that don't match keep whatever they already are on the server. A key that is already a secret stays a secret even when you leave it out of --secrets. New keys are plain.
• --all-secrets makes everything a secret; --no-secrets makes everything plain. The three options can't be combined.
• If an entry in --secrets matches no key in your file, you get a warning (not an error) so a typo doesn't go unnoticed.

Empty values:

A secret can't be empty. If any key that would end up as a secret has an empty value, the push stops before anything is written and lists every offending key:

✖ Push aborted: 2 secrets have an empty value
  STRIPE_KEY
  DB_PASSWORD

Plain variables may be empty.

Dry run output:

✔ Dry run — no changes made

  Project:     acme-api
  Environment: production
  Service:     worker (will be created)
  Variables:   12  (3 new, 9 updated)
  Secrets:     STRIPE_KEY, DB_PASSWORD

Variables to push:
  PORT=3000
  STRIPE_KEY=•••••• [secret] [new]

A dry run performs every check the real push does (authentication, project/environment/service lookup, naming conventions, empty secrets), so a successful dry run means the push will succeed.

service

Manage services — named subdivisions of a project such as api or worker that keep their own set of variables per environment.

service create

envmanager service create <name> [options]

Options:

The command is safe to run repeatedly: if the service already exists (names are matched case-insensitively) it reports that and exits successfully, so it can run unconditionally in CI. Only organization owners and admins can create services.

envmanager service create worker --description "Background jobs"
envmanager push --service worker

diff

Compare local .env file with remote variables.

envmanager diff [options]

Options:

Output:

Comparing .env with development environment

+ NEW_VAR=value          # Only in local
- OLD_VAR                # Only in remote
~ API_URL                # Different values
  DATABASE_URL           # Same (secret - values hidden)

Summary: 1 added, 1 removed, 1 changed, 8 unchanged

Secret values are never shown in diff output.

list

List projects, environments, or variables.

envmanager list <type> [options]

Types:

Options:

Examples:

# List all projects
envmanager list projects

# List environments in a project
envmanager list environments --project abc123

# List variables (uses config if no project specified)
envmanager list variables

# Verbose output with IDs
envmanager list projects --verbose

Output:

Projects:
  my-app           3 environments
  backend-api      2 environments
  marketing-site   4 environments

Variables in development:
  DATABASE_URL     [secret]
  API_KEY          [secret]
  DEBUG            false
  LOG_LEVEL        info
  PORT             3000

config

Manage project configuration.

envmanager config <action> [options]

Actions:

Examples:

# Initialize configuration
envmanager config init

# Get current project
envmanager config get project_id

# Change environment
envmanager config set environment staging

debug

Collect diagnostic info for troubleshooting. Share the output with support when reporting issues.

envmanager debug

Output:

=== EnvManager CLI Debug Report ===
Timestamp: 2026-02-19T15:48:27.806Z
CLI Version: 0.1.5
Node: v22.14.0
Platform: darwin arm64

--- Config ---
Config file: /path/to/envmanager.json
  project_id: not set
  environment: not set

--- Authentication ---
Auth method: CLI session key (em_abc1234...)
API URL: default (production)

--- API Connection ---
Auth exchange: 120ms
getUser: 45ms
  User ID: abc-123...
  Email: user@example.com
Org query: 32ms
  Organizations (1):
    - My Org (owner) [abc12345...]

=== End Debug Report ===

API keys are partially redacted. No secrets are exposed.

Common Workflows

Initial Setup

# Login once
envmanager login

# Initialize project
envmanager init --project <id>

# Pull current variables
envmanager pull

Daily Development

# Check what's different
envmanager diff

# Pull latest changes
envmanager pull --force

# Or use real-time sync
envmanager dev

Updating Production

# Compare with production
envmanager diff --environment production

# Push changes (with review)
envmanager push --environment production

# Or dry-run first
envmanager push --environment production --dry-run