Production

Run your application with one platform secret: ENVLET_TOKEN. The token identifies one project environment, so your host does not need more Envlet configuration.

At startup, Envlet resolves the values that the token’s identity may read. Shared values stay shared, overrides replace them, and withheld values do not enter the workload.

Add the bootstrap token

1. Open the Envlet dashboard and create a token for the production environment.

2. Choose the token TTL. Every token expires, and the maximum TTL is 366 days.

3. Copy the token when Envlet shows it. Envlet shows the raw token once and stores only its digest.

4. Add the token to your host platform as ENVLET_TOKEN. Do not put it in your image or repository.

5. Start the workload with one of the methods below.

Load values at startup

Node SDK

Install the SDK:

npm install @envlet/sdk

Inject values before you import the rest of your application:

import { inject } from "@envlet/sdk";

await inject();
await import("./app.js");

inject() sets process.env in Node. Values already set by the host win by default. Use await inject({ override: true }) when Envlet must replace them.

The SDK fetches values once at boot. Restart the process to pick up changes. It retries briefly after network errors and server errors, then throws a typed error instead of returning stale or partial values.

See the Node SDK reference for load(), get(), and the error types.

Docker

Install the CLI in the image and make envlet run the entrypoint:

FROM node:22-slim
WORKDIR /app
COPY package*.json ./
RUN npm ci && npm install --global @envlet/cli
COPY . .
ENTRYPOINT ["envlet", "run", "--"]
CMD ["node", "dist/index.js"]

Set ENVLET_TOKEN through the container platform’s secret configuration. When the container starts, envlet run resolves the environment and starts the command from CMD.

See the CLI reference for the full command surface.

Any HTTP runtime

Call the REST API from any runtime that can make an HTTPS request:

curl --fail-with-body \
  --header "Authorization: Bearer $ENVLET_TOKEN" \
  https://api.envlet.dev/v1/values

The response is JSON with a values object. Its keys already reflect the identity policy. Overrides are substituted, and withheld keys are absent.

An expired token returns HTTP 401 with code token_expired. Check the response status before you start the workload.

See the REST API reference for single-value and dotenv responses.

Keep the bootstrap secret out of source

Store ENVLET_TOKEN in the secret store for your host platform. Do not commit it, copy it into a Docker image, or print it in startup logs.

Rotate and revoke tokens

Envlet emails your organization 30, 7, and 1 days before a token expires. Use that time to replace the token before the workload loses access.

For a planned rotation:

1. Create a replacement token for the same environment and choose its TTL.

2. Replace ENVLET_TOKEN in the host platform.

3. Restart or redeploy the workload so it starts with the replacement token.

4. Revoke the old token in the dashboard.

Revocation is immediate. A leaked token can open only the project environment that it identifies, and it cannot be used after revocation or expiry.

Keep production credentials away from coding agents

Give each coding agent its own Envlet identity and token. Do not give an agent the production workload token.

Set each variable to shared, overridden, or withheld for that agent. Withhold production credentials that the agent does not need, or give it a separate value for the same variable name.

Each agent token works for one project environment and expires. This keeps the agent’s access separate from human, CI, and production runtime access.

Review Security for encryption, token storage, and resolution audit details.