> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enver-os.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# ev pull

> Download and decrypt secrets from Enver into your local .env file.

# ev pull

Fetches the encrypted secret payload from Enver, decrypts it locally using the provided lock key, and merges the variables into your `.env` file.

## Usage

```bash theme={null}
ev pull <lock-key> [options]
```

## Arguments

| Argument   | Required | Description                                                  |
| ---------- | -------- | ------------------------------------------------------------ |
| `lock-key` | Yes      | The passphrase used when secrets were pushed with `ev push`. |

## Options

| Flag                  | Description                                                       |
| --------------------- | ----------------------------------------------------------------- |
| `--project <id>`      | Override the project ID from `.ev.json`                           |
| `--env <environment>` | Override the environment (`DEVELOPMENT`, `STAGING`, `PRODUCTION`) |

## Examples

```bash theme={null}
# Pull using project from .ev.json
ev pull my-secret-passphrase

# Pull PRODUCTION secrets
ev pull my-secret-passphrase --env PRODUCTION
```

## Output

```
⠿ Fetching secret payload for [my-saas-app] (DEVELOPMENT)...
⠿ Decrypting secrets locally...
✓ Successfully pulled and decrypted envs into .env (DEVELOPMENT)
```

## Merge behaviour

`ev pull` **merges** secrets into your existing `.env` — it does not overwrite the entire file. Remote variables take precedence over existing local values for the same key.

## How decryption works

1. Downloads the ciphertext and 5 key shares from the server
2. Reconstructs the master key using 3 of the 5 Shamir shares
3. Derives the AES key from your lock key using PBKDF2
4. Decrypts the ciphertext with AES-256-GCM
5. Writes the plaintext variables into `.env`

<Note>
  Decryption is entirely **local**. The server never sees your lock key or plaintext secrets at any point.
</Note>

## Required token scope

Your API token must have at least `read:secrets` scope.