ev push

Encrypt and push your local .env file to Enver.

ev push

Reads your local .env file, encrypts it client-side using AES-256-GCM + Shamir’s Secret Sharing, and uploads the ciphertext to Enver.

Usage

ev push <lock-key> [options]

Arguments

Argument	Required	Description
lock-key	Yes	The passphrase used to derive the AES encryption key. Required to pull secrets later.

Options

Flag	Description
--project <id>	Override the project ID from .ev.json
--env <environment>	Override the environment (DEVELOPMENT, STAGING, PRODUCTION)

Examples

# Push using project from .ev.json, DEVELOPMENT environment
ev push my-secret-passphrase

# Push to PRODUCTION
ev push my-secret-passphrase --env PRODUCTION

# Push to a specific project
ev push my-secret-passphrase --project my-other-app --env STAGING

Output

⠿ Reading local .env file...
⠿ Encrypting with AES-256-GCM + Shamir SSS...
⠿ Uploading encrypted payload to PRODUCTION...
✓ Successfully encrypted & pushed .env to remote (PRODUCTION)

How encryption works

1. Generates a random 256-bit master key
2. Splits it into 5 Shamir shares (threshold: 3)
3. Derives an AES key from your lock key using PBKDF2 (100,000 iterations, SHA-256)
4. Encrypts the .env content with AES-256-GCM
5. Uploads the ciphertext + all 5 shares to the server

The lock key is not stored anywhere by Enver. If you lose it, your secrets cannot be recovered. Store it securely (e.g., a password manager).

Required token scope

Your API token must have write:secrets or admin scope.