CLI Overview

The Envshed CLI (envshed) lets you manage secrets from the terminal.

Commands

Command	Description
envshed init	Create a .envshed.json project config
envshed login	Authenticate with Envshed
envshed whoami	Show the currently logged-in user
envshed branch	Show the current environment context
envshed env	Manage environments (subcommands: list, create, update, delete, duplicate, checkout)
envshed secret	Manage individual secrets (get, set, delete, override)
envshed definition	Manage secret definitions (subcommands: list, create, update, delete)
envshed member	Manage org members (subcommands: list, invite, role, remove)
envshed webhook	Manage webhooks for an organization
envshed env-version	Check the current environment version
envshed pull	Pull secrets to a .env file
envshed push	Push secrets from a .env file
envshed diff	Compare secrets between two environments
envshed import <file>	Import secrets from a .env, JSON, YAML, or CSV file
envshed run	Run a command with secrets injected
envshed org	Manage organizations (subcommands: list, create)
envshed project	Manage projects (subcommands: list, create, update, delete)
envshed envs	List environments in a project
envshed rename-env	Rename an environment
envshed token	Manage personal and service tokens (subcommands: set, clear, show, create-service, list-service, revoke-service, update-service)
envshed workspace	Manage monorepo workspaces
envshed link	Link a secret to another project
envshed unlink	Unlink a secret from its cross-project link
envshed versions	List version history for a secret
envshed rollback	Roll back a secret to a previous version
envshed snapshot	Manage environment snapshots
envshed completions	Generate shell completion scripts

Global Options

Flag	Description
--locale <code>	Override the display language (e.g., en, es). Defaults to system locale.
-w, --workspace <path>	Target a specific workspace in a monorepo config. See Workspaces.
-a, --all	Run for all workspaces in bulk mode (even when a root project is configured).

Global behavior

All commands that operate on secrets (pull, push, run) require three pieces of context: organization, project, and environment. These can be provided via:

1. CLI flags (-o, -p, -e)
2. Project config (.envshed.json)

See Configuration for the full resolution order.

When context is resolved from config, the CLI prints it before executing:

  my-org / my-project / development

Language / Locale

The CLI supports multiple languages. The display language is resolved in this order:

1. --locale flag (e.g., envshed --locale es pull)
2. locale field in ~/.envshed/config.json
3. System locale (LANG / LC_ALL environment variables)
4. Default: en (English)

Currently supported: en (English), es (Spanish).