varsSetup & Auth
Initialize a project, manage your encryption key, run health checks, and install the pre-commit hook.
init
vars initSets up a new vars project:
- Creates
config.vars, the encrypted secrets file (safe to commit) - Creates
.varskey, the master encryption key (gitignored) - Updates
.gitignoreto exclude key and swap files - Adds
#varsimport topackage.jsonscripts
If .env, .env.local, .env.example, or .env.sample exists, vars imports the first match, guesses Zod schemas from its values, detects framework-specific public prefixes, and encrypts secret values before writing.
If a committed config.vars already exists but .varskey is missing, do not initialize a new key: it cannot decrypt that file. Provision the matching encrypted envelope with vars key import.
Flags
| Flag | Short | Description |
|---|---|---|
--pin <pin> | Set the PIN non-interactively for trusted automation | |
--pin-file <path> | Read the PIN from a file; preferred for automation |
vars init --pin-file /run/secrets/new-project-pin--pin exposes the PIN in process arguments and may expose it through shell history or agent logs. Prefer --pin-file with a mode-0600 file for trusted automation.Key Management
Subcommands for managing your encryption key.
Multi-PIN
Owner-scoped PINs for team access control. See Multi-PIN for the full explanation.