varsCLI Workflow
All vars commands at a glance.
Commands
| Command | Description |
|---|---|
vars init | Initialize vars in your project — creates config, key, gitignore, hook |
vars gen <file> | Generate TypeScript types from a .vars file. --platform node | serverless | deno | static selects the output shape. cloudflare was removed in the current major — use serverless instead. |
vars show [file] | Decrypt a .vars file in-place for editing |
vars hide | Encrypt all unlocked .vars files |
vars run --env <env> -- cmd | Run a command with decrypted env vars injected |
vars check [-f file] | Validate schemas and run check blocks |
vars add <name> | Add a variable directly to a locked file |
vars set <name> | Update a variable directly in a locked file |
vars remove <name> | Remove a variable directly from a locked file |
vars ls | List all .vars files with lock state and var count |
vars ls <file> | List variables in a file with metadata |
vars export --env <env> | Export as dotenv, json, or k8s-secret format |
vars apply | Atomically upsert a .vars fragment from stdin without unlocking |
vars key init | Create a new encryption key |
vars rotate | Rotate the encryption key |
vars key export | Print the raw base64 master key as a compatibility escape hatch |
vars doctor | Diagnose your vars setup |
Environment
| Variable | Description |
|---|---|
VARS_KEY | Raw base64 master key compatibility escape hatch for CI systems that cannot provision an envelope. |
VARS_PIN | PIN for trusted non-interactive use. Overridden by --pin; may expose all secrets available to that PIN. |
VARS_PIN_FILE | Path to a PIN file. Recommended instead of VARS_PIN for trusted automation; VARS_PIN wins if both are set. |
VARS_KEY_FILE | Path to an encrypted key envelope. Defaults to the nearest .varskey. |
Trusted automation
Commands that set or unlock a PIN accept --pin <pin> or the safer --pin-file <path>. Commands also accept --key-file <path> when the encrypted key envelope is provisioned outside the project:
vars init --pin-file /run/secrets/vars-pin
vars run --env dev \
--key-file /run/secrets/project.varskey \
--pin-file /run/secrets/vars-pin \
-- npm start
# Existing package scripts
VARS_KEY_FILE=/run/secrets/project.varskey \
VARS_PIN_FILE=/run/secrets/vars-pin \
pnpm startTrusted agents should mutate locked files with vars add, vars set, vars remove, or vars apply. vars show and vars hide are the human editor workflow.
--pin can appear in process listings, shell history, agent transcripts, and command logs. Prefer --pin-file with a mode-0600 file. The PIN and encrypted key envelope are both required; vars does not derive the master key directly from the PIN.Guides
- Setup & Auth — init, key management, doctor
- Managing Variables — show, hide, add, remove, ls
- Running Apps — run, gen, check, export, platform targets