ev pull

Download and decrypt secrets from Enver into your local .env file.

ev pull

Fetches the encrypted secret payload from Enver, decrypts it locally using the provided lock key, and merges the variables into your .env file.

Usage

ev pull <lock-key> [options]

Arguments

Argument	Required	Description
lock-key	Yes	The passphrase used when secrets were pushed with ev push.

Options

Flag	Description
--project <id>	Override the project ID from .ev.json
--env <environment>	Override the environment (DEVELOPMENT, STAGING, PRODUCTION)

Examples

# Pull using project from .ev.json
ev pull my-secret-passphrase

# Pull PRODUCTION secrets
ev pull my-secret-passphrase --env PRODUCTION

Output

⠿ Fetching secret payload for [my-saas-app] (DEVELOPMENT)...
⠿ Decrypting secrets locally...
✓ Successfully pulled and decrypted envs into .env (DEVELOPMENT)

Merge behaviour

ev pull merges secrets into your existing .env — it does not overwrite the entire file. Remote variables take precedence over existing local values for the same key.

How decryption works

1. Downloads the ciphertext and 5 key shares from the server
2. Reconstructs the master key using 3 of the 5 Shamir shares
3. Derives the AES key from your lock key using PBKDF2
4. Decrypts the ciphertext with AES-256-GCM
5. Writes the plaintext variables into .env

Decryption is entirely local. The server never sees your lock key or plaintext secrets at any point.

Required token scope

Your API token must have at least read:secrets scope.