How to
How to inject secrets without a .env file
For local Node.js and Next.js apps, prefix the command you already use with `runenv run --`. The CLI fetches the selected environment and starts the child process with those values in its environment.
How it works
Three steps for the supported path.
- 01
Install and sign in
Run `npm install -g runenv-cli`, then `runenv login`. Use Node.js 20 or newer.
- 02
Link the project and environment
From the app directory, run `runenv quickstart` so the repo is linked to a development environment without storing secret values in `.runenv.json`.
- 03
Start the process
Run `runenv run -- npm start` or `runenv run -- next dev`. Restart the process after a value change unless you are on a documented live-reload path.
The command
Instead of `npm start` or `next dev`, run `runenv run -- npm start` or `runenv run -- next dev`. Applications keep reading `process.env` as usual.
- Install the CLI with `npm install -g runenv-cli`.
- Authenticate with `runenv login`.
- Link the repo with `runenv quickstart` or `runenv init`.
What this path does not write
The bootstrap and `runenv run` flows do not write secret values to `.env`, `.env.local`, logs, or `.runenv.json`. Download, `runenv dotenv`, offline-cache, and `*_FILE` workflows are different storage boundaries.
CI and production
Use a scoped service token in GitHub Actions and bind each workflow to one RunEnv environment. Prefer process-level injection. Do not bake resolved values into image layers or artifacts.