CLI reference

npm install -g @envlet/cli

The package installs the envlet command. Run envlet --help or envlet -h to print the command list.

The init, run, list, pull, set, and types commands must run inside a Git repository. init creates the repository selection that the other five commands use.

`envlet login`

Usage: envlet login

Start a browser login and save a credential for later CLI commands. The command prints a URL and a short code, then waits for you to approve the login in your browser.

Envlet saves the credential in ~/.envlet/credentials.json with file mode 0600. The command does not accept flags or arguments.

Example:

envlet login

`envlet mcp`

Usage: envlet mcp

Start the Envlet MCP stdio server for Claude Code, Cursor, or Codex. Protocol messages use stdout. The command does not accept flags or arguments.

See MCP server for client setup, tools, migration flow, and token handling.

`envlet init [--force]`

Usage: envlet init [--force]

Select a project and environment for the current Git repository. Envlet uses the credential saved by envlet login, asks you to select a project and environment, and writes .envlet at the repository root.

The .envlet file stores the selected project and environment names and stable IDs. Commit this file so each identity resolves the same project and environment.

With no flag, the command stops if .envlet already exists.
--force replaces the existing .envlet file.

Example:

envlet init

`envlet types [--check] [--language <id>] [--output <path>]`

Usage: envlet types [--check] [--language <id>] [--output <path>]

Generate one typed environment file from the variable names in the project and environment selected by .envlet. Generation needs a manage credential from envlet login or ENVLET_TOKEN. A resolve token from ENVLET_TOKEN works only with --check. The command never fetches variable values.

On the first run, select typescript, python, go, rust, php, elixir, or ruby and enter a repository-relative output path. You can pass --language and --output instead. Envlet records both settings under types in .envlet. Later runs read those settings, so do not pass them again.

For Go, write the file to a dedicated package directory. The generated file declares package envletconfig.

Run envlet types once before you use --check. The check command never writes the generated file or .envlet. It compares the generated output with the environment’s full name set, prints added and removed names, and exits with status 1 when the file is out of date. With ENVLET_TOKEN, names identified by the API as withheld are printed as withheld for this token. Withheld status does not change the check result.

Example:

envlet types --language typescript --output src/envlet.d.ts
envlet types --check

See Typed environments for generated output and a CI example.

`envlet run -- <command> [arguments...]`

Usage: envlet run -- <command> [arguments...]

Resolve the variables allowed for the active identity and start a child command with them. The -- separator is required. Everything after it is the child command and its arguments.

The child inherits your current environment, except for ENVLET_TOKEN. Resolved Envlet values replace inherited values with the same names. The child uses your terminal input and output, and its exit status becomes the Envlet exit status.

Example:

export ENVLET_TOKEN="paste-the-token-here"
envlet run -- npm test

`envlet list [--values]`

Usage: envlet list [--values]

Resolve the active identity’s variables and print them in name order.

With no flag, the command prints variable names only.
--values prints each name and its JSON-quoted value as NAME="value". This can expose secrets in terminal output or logs.

Example:

envlet list --values

`envlet pull [--force]`

Usage: envlet pull [--force]

Resolve the active identity’s variables and write them to .env at the repository root. The file contains plaintext values and uses file mode 0600.

Envlet warns if Git tracks .env or if the root .gitignore does not ignore it. Load this file with a dotenv-compatible tool. Do not source it in a shell.

With no flag, the command stops if .env already exists.
--force replaces an existing regular .env file. It does not replace a symbolic link or another file type.

If a value cannot be written without changing it, the command stops. Use envlet run for that value because it does not write variables to disk.

Example:

envlet pull --force

`envlet set KEY=value`

Usage: envlet set KEY=value [--type <id>] [--required|--optional] [--enum <values>] [--description <text>] [--as <identity>]

Create or update a variable in the project and environment selected by .envlet. This command requires a manage credential.

--type accepts string, integer, number, boolean, url, json, or enum.
--required and --optional set whether an absent resolved value is an error.
--enum a,b,c sets unique, non-empty enum values and implies --type enum.
--description sets variable metadata.
--as <identity> sets an override for one identity. Schema flags cannot be used with --as.

Validation errors print the variable name and a machine code. They do not print the value. If ENVLET_TOKEN is a resolve token, remove it or provide a manage token.

Quote KEY=value when the value contains spaces or shell characters.

envlet set PORT=8080 --type integer --required
envlet set MODE=production --type enum --enum development,production
envlet set LOG_LEVEL=debug --as ci-preview