CLI Reference

The runenv-cli is the command-line interface for the RunEnv platform. It allows you to manage projects, secrets, and run applications with securely injected environment variables.

Installation

npm install -g runenv-cli

Global Flags

--server <url>: Override the default API server URL. Useful for self-hosted instances.
--token <token>: Authenticate using a service token instead of a user session.
--verbose: Enable debug logging.

Core Commands

`runenv login`

Authenticates the CLI with the RunEnv platform using a secure OAuth flow.

runenv login

`runenv init`

Links your current directory to a RunEnv project and environment. Creates a .runenv.json file.

runenv init --project <project-id> --env <environment-name>

For a guided, repo-aware first setup, prefer runenv quickstart. It can detect the repository, link a project, select an environment, and launch a safe dev command.

`runenv link`

Create or update the non-secret .runenv.json link file for the current directory.

runenv link --project my-api --env development
runenv link --project my-api --preset nextjs

`runenv run`

The most important command. It fetches your secrets from the platform and runs your application with them injected into the environment.

runenv run -- <your-command>

Example:

runenv run -- npm run dev

`runenv file`

Manage File Secrets: encrypted credential files with metadata, audit, and controlled delivery.

runenv file add serviceAccountKey.json --key GOOGLE_APPLICATION_CREDENTIALS_FILE
runenv file list
runenv file inspect GOOGLE_APPLICATION_CREDENTIALS_FILE
runenv file download GOOGLE_APPLICATION_CREDENTIALS_FILE --out serviceAccountKey.json

Temp-file File Secrets are mounted by runenv run as private temporary files. Sidecar-memory File Secrets are served by runenv-agent for long-running services and zero-disk proof workflows.

`runenv env`

Prints the current environment variables to standard output. Useful for debugging or piping to other tools.

runenv env

Security Warning

Be careful when using this command in CI/CD environments, as it will print your secrets in plain text to the console logs unless you mask them.

Local files, comparison, and validation

Use these workflows carefully: they may intentionally read or write local environment files.

# Compare local keys with the configured environment
runenv diff --keys-only
 
# Validate a project or a local override file
runenv validate --strict
runenv validate --file .env.production.local
 
# Generate a redacted example file
runenv sync-example
 
# Create a local file only when a tool requires it, then remove it
runenv dotenv --setup
runenv dotenv --clean

runenv scan detects likely secrets in a directory, while runenv generate-types can generate typed environment-key declarations. Use runenv status, runenv whoami, and runenv doctor to diagnose login, linking, and local setup without exposing values.

File Secrets

File Secrets are encrypted credential files with metadata, audit, and controlled delivery.

runenv file add serviceAccountKey.json --key GOOGLE_APPLICATION_CREDENTIALS_FILE
runenv file list
runenv file inspect GOOGLE_APPLICATION_CREDENTIALS_FILE
runenv file download GOOGLE_APPLICATION_CREDENTIALS_FILE --out serviceAccountKey.json

Downloading a File Secret requires explicit value-read access. For a process that supports runtime delivery, prefer runenv run or the sidecar agent over a persistent local file.

Enterprise Commands

`runenv transit encrypt/decrypt`

Encrypt or decrypt data using the Transit Secrets Engine.

runenv transit encrypt --key my-key --plaintext "sensitive data"

`runenv lease`

Request, renew, or revoke dynamic, short-lived credentials.

runenv lease request <policy>

For terminal-bound renewal, use runenv lease watch <lease-id>. Long-running services should use the RunEnv agent sidecar for memory delivery, reload hooks, and graceful revocation.

Command help is authoritative

The CLI evolves independently of the Dashboard. Before automating a command or using an uncommon option, run:

runenv help
runenv help <command>