Protected Environments

A protected environment does not accept changes directly. Every edit, import, rollback or CLI push becomes a pending change that somebody has to approve before it takes effect. It is the safety net for Production: nothing goes live because one person clicked Save at the wrong moment.

Turning protection on

Approval modes

Members and viewers can never approve, in any mode. They can submit changes if they have write access to the environment, but somebody with the owner or admin role has to sign off.

Who approves your own changes

Normally you cannot approve your own request. That is the whole point: a second pair of eyes looks at the change before it goes live.

There is one exception. If you are the only owner or admin in the organization, you can approve and reject your own changes. Otherwise a solo founder who turns on Require Approval would lock themselves out of their own Production environment, with a queue nobody in the world could clear.

A few things follow from that:

• When you turn on Require Approval as the only administrator, EnvManager shows a short note saying so. Nothing is blocked; it is just telling you that approval will not involve anyone else yet.
• The moment you invite a second owner or admin, the exception stops applying. Your own requests then wait for them, and theirs wait for you.
• A self-approval is recorded. The change's comment gets "(self-approved: sole administrator)" appended, so the audit trail shows what happened.
• Two-Person Approval is never relaxed. It always needs two different administrators, so on a one-person organization nothing can be approved at all. If you pick that mode on your own, EnvManager warns you and you should either invite a teammate or switch to Single Approver.

Reviewing pending changes

There are two places to review:

• Pending Approvals in the dashboard sidebar, which lists everything waiting across all your projects.
• The Pending tab on a protected environment inside a project, for that environment only.

Each entry shows what would change, who asked for it, when, and any comment they left. Click Approve to open a review dialog with the before-and-after values; secret values start masked and you reveal them deliberately. Approve & Apply writes the change immediately. Reject asks for an optional reason, which the requester sees.

If the buttons are not there, the line underneath the request explains why. You will see either "You submitted this change. An owner or admin has to approve it, or you can cancel it." or, for Two-Person Approval, a note that a second administrator is needed.

Cancelling your own request

You can always withdraw a request you made yourself: click Cancel request on the entry. That is the way out of a queue you cannot approve, and it does not need anybody else. Owners and admins can also cancel other people's requests to clear a stale queue.

Importing into a protected environment

Importing a .env file into a protected environment does not add any variables. Each line becomes its own pending change, and the confirmation says "Submitted N variables for approval. Approve them under Pending Approvals." The variables appear in the list only after approval.

Using the CLI on a protected environment

envmanager push and envmanager set behave the same way: nothing is written, everything is queued. The CLI tells you so:

Submitted 11 variables for approval on production.
Approve them in the dashboard under Pending Approvals.

Two things to know:

• There is no CLI command to approve. Approval happens in the dashboard.
• Auto-sync to Render, Vercel and the other integrations is skipped, because there is nothing to send yet. The sync happens as part of applying the change once it is approved.
• envmanager push --dry-run tells you up front whether the target environment is protected.

Older CLI versions (0.7.0 and earlier) reported "Pushed N variables" here even though nothing was written. Upgrade with npm install -g @envmanager-cli/cli@latest if you see that.

Auto-expiring old requests

Under the approval mode you can set Auto-expire Pending Changes. A request that nobody acts on within that window is closed automatically instead of sitting in the queue forever. The default is Never.

Next Steps