Copy-paste is the sync engine
Rotate a database password and you open every application that uses it, one by one, and paste the new one in. Miss one and that app fails at night, usually the one you forgot existed.
For teams on Dokploy and Coolify
The secrets manager that actually syncs to Dokploy and Coolify
You moved off Heroku or Vercel to run your own PaaS, and now every application's environment variables live in that application's settings page. With twelve apps and three environments the only sync tool you have is copy-paste. We treat Dokploy and Coolify as proper sync targets, the same as Vercel: one place for the values, a token to your instance, and every change you make lands on the platform on the next sync.
"Worked flawlessly integrating into Dokploy. Not all did."
What running your own PaaS does to your secrets
Staging ends up with production keys
When the only way to set up a new environment is to copy the old one, the production values travel with it, and nobody notices until staging sends a real email to a real customer.
Everyone with platform access sees everything
Dokploy and Coolify show variables in plaintext to anyone who can open the app. There is no "developers see staging only" on the platform itself.
No record of who changed what
A value changed last Tuesday and broke the worker. The settings page shows the current value and nothing else.
How the sync works
Connect once, map each app, and stop opening settings pages.
1. Connect your instance
Create an API token in Dokploy or Coolify, paste it together with your instance URL, and add a CA certificate if you run your own. The connection belongs to your organization and can be reused for every app.
2. Map environment to application
A sync target says: this environment, limited to this service, goes to that application through that connection. Production api to the api app, production worker to the worker app, and so on.
3. Sync, by hand or on every change
Hit Sync Now the first time and watch the variables land. Turn on auto-sync for the target and from then on every push from the CLI or edit in the dashboard syncs for you. Keys that left the scope are removed on the platform.
Services: the api gets its keys, the worker gets its own
Most Dokploy and Coolify setups are several small apps sharing a database and a few third-party keys. In EnvManager you define services inside a project, mark a variable as shared or scope it to one service, and point each sync target at one service. The api application receives the shared values plus its own, the worker receives the shared values plus its own, and neither gets the other's. If a service has no target at all we warn you instead of silently sending nothing.
Stale keys get removed too
Delete a variable here, or move it to a different service, and the next sync removes it from the application on the platform. Copy-paste workflows never do that part, which is how a worker keeps a queue URL from two migrations ago. We keep a record of every key each target has sent, so we know exactly what to take back.
The self-hosting details we took care of
Self-signed certificates
Upload the CA certificate for your instance and we verify against it. No "disable TLS verification" checkbox.
Private networks
The sync calls your instance's API from our side, so it has to be reachable: a public hostname, an allowlist, or a tunnel all work. For an instance nobody outside can reach, run envmanager pull from inside the network in your deploy step instead.
Docker and git-based deploys
Works with the way Dokploy and Coolify actually deploy. We set application-level variables the platform then hands to the container.
Many small apps, one price
A self-hosted PaaS tends to grow into a fleet of small applications. There is no per-app, per-target or per-seat charge, so the fleet costs the same as one app.
Migrated and syncing in 30 minutes, or we do it with you
Paste the .env from your first application, create the Dokploy or Coolify connection with an API token, pick the app, and sync. For most teams the first app is done in ten minutes and the rest follow the same pattern. Hit something odd, like a self-signed certificate or a weird proxy? Book a call and we sit down together until it syncs. We built and tested this against real instances, so there is a fair chance we have seen your setup before.
Book a migration callQuestions we get
Does the sync run automatically?
If you want it to. Auto-sync is a switch per target. With it on, every change pushed from the CLI or made in the dashboard syncs to every target that covers the changed variable. With it off, you hit Sync Now when you are ready.
What happens to variables I set directly in Dokploy or Coolify?
A sync target only manages the keys it has sent. Keys you set on the platform by hand and never put in EnvManager are left alone. Keys we sent and you later removed here get removed there.
Can I keep using the platform UI for some things?
You can, but the cleanest setup is one direction: EnvManager is the source and the platform is a destination. If you edit a managed key on the platform anyway, the next sync overwrites it with our value.
Do you also sync to Vercel, Railway, GitHub Actions and the clouds?
Yes. Dokploy and Coolify sit next to Vercel, Railway, Render, GitHub Actions, AWS Secrets Manager, Azure Key Vault and Google Cloud, so a team with a marketing site on Vercel and everything else on Dokploy keeps one source of truth.
One place for every app's variables
14 days free, no card. One flat price for the whole team afterwards, however many apps you run. 49 founding spots left at $9 a month.