ev pull
Fetches the encrypted secret payload from Enver, decrypts it locally using the provided lock key, and merges the variables into your.env file.
Usage
Arguments
Options
Examples
Output
Merge behaviour
ev pull merges secrets into your existing .env — it does not overwrite the entire file. Remote variables take precedence over existing local values for the same key.
How decryption works
- Downloads the ciphertext and 5 key shares from the server
- Reconstructs the master key using 3 of the 5 Shamir shares
- Derives the AES key from your lock key using PBKDF2
- Decrypts the ciphertext with AES-256-GCM
- Writes the plaintext variables into
.env
Decryption is entirely local. The server never sees your lock key or plaintext secrets at any point.
Required token scope
Your API token must have at leastread:secrets scope.