ev push
Reads your local .env file, encrypts it client-side using AES-256-GCM + Shamir’s Secret Sharing, and uploads the ciphertext to Enver.
Usage
Arguments
Options
Examples
Output
How encryption works
- Generates a random 256-bit master key
- Splits it into 5 Shamir shares (threshold: 3)
- Derives an AES key from your lock key using PBKDF2 (100,000 iterations, SHA-256)
- Encrypts the
.env content with AES-256-GCM
- Uploads the ciphertext + all 5 shares to the server
The lock key is not stored anywhere by Enver. If you lose it, your secrets cannot be recovered. Store it securely (e.g., a password manager).
Required token scope
Your API token must have write:secrets or admin scope.
