Secrets live in the cloud, organized by environment. You manage them directly from the terminal: set, ls, and rm all act on the active cloud environment, with no local file in the loop. When a tool insists on a .env file, pull, push, and diff bridge the cloud to a local copy.

Set, list, and remove

These three commands operate on the active cloud environment — the source of truth. Nothing is written to disk.

vexly set DATABASE_URL=postgres://localhost/myapp   # add or update a secret
vexly ls                                            # list keys (values masked)
vexly rm DATABASE_URL                               # remove a secret

vexly set accepts one or more KEY=value pairs and writes them straight to the cloud:

vexly set STRIPE_SECRET_KEY=sk_live_… API_BASE_URL=https://api.example.com

To declare a key now and fill its value in later — for example before sending a secret update request — set it with no value:

vexly set STRIPE_SECRET_KEY

vexly ls lists the environment’s keys with values masked. Pass --reveal to print the actual values (only on a readable environment):

vexly ls
# KEY                VALUE
# DATABASE_URL       ***
# STRIPE_SECRET_KEY  ***

vexly ls --reveal
# KEY                VALUE
# DATABASE_URL       postgres://localhost/myapp
# STRIPE_SECRET_KEY  sk_live_…

vexly rm removes one or more keys from the cloud environment:

vexly rm OLD_KEY ANOTHER_OLD_KEY

All three accept --env <slug> to act on an environment other than the active one:

vexly set FEATURE_FLAG=on --env development
vexly ls --env production

The local .env bridge

You don’t need a file to use your secrets — vexly run injects them straight into a process. But some tools only read a .env, you may want to work offline, or you may be migrating an existing .env into Vexly. Three commands bridge the cloud and a local file:

• vexly pull writes the active environment’s secrets into a local .env.
• vexly push replaces the cloud environment with your local .env.
• vexly diff shows what differs between the two, changing nothing.

vexly pull            # cloud → local .env
vexly diff            # preview local vs cloud
vexly push            # local .env → cloud (replaces the environment)

vexly push is replace-only: keys present in the cloud but missing from your local .env are deleted. Before writing anything it shows a categorized preview — keys added, changed, and deleted — and waits for your confirmation. Pass --yes to skip the prompt in scripts and CI, and --env <slug> to target a specific environment:

vexly push --env production --yes

vexly pull is refused on a run-only environment — those secrets can only be injected via vexly run, never downloaded.

If you keep a local .env, gitignore it yourself: vexly init does not modify .gitignore. See files & git for what to commit.

Commands

Next

• Run a command with secrets injected — no file needed.
• Ask someone to fill in a secret out-of-band.
• Environments — switch and target environments.