> ## Documentation Index
> Fetch the complete documentation index at: https://docs.enver-os.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# ev push

> Encrypt and push your local .env file to Enver.

# ev push

Reads your local `.env` file, encrypts it client-side using AES-256-GCM + Shamir's Secret Sharing, and uploads the ciphertext to Enver.

## Usage

```bash theme={null}
ev push <lock-key> [options]
```

## Arguments

| Argument   | Required | Description                                                                           |
| ---------- | -------- | ------------------------------------------------------------------------------------- |
| `lock-key` | Yes      | The passphrase used to derive the AES encryption key. Required to pull secrets later. |

## Options

| Flag                  | Description                                                       |
| --------------------- | ----------------------------------------------------------------- |
| `--project <id>`      | Override the project ID from `.ev.json`                           |
| `--env <environment>` | Override the environment (`DEVELOPMENT`, `STAGING`, `PRODUCTION`) |

## Examples

```bash theme={null}
# Push using project from .ev.json, DEVELOPMENT environment
ev push my-secret-passphrase

# Push to PRODUCTION
ev push my-secret-passphrase --env PRODUCTION

# Push to a specific project
ev push my-secret-passphrase --project my-other-app --env STAGING
```

## Output

```
⠿ Reading local .env file...
⠿ Encrypting with AES-256-GCM + Shamir SSS...
⠿ Uploading encrypted payload to PRODUCTION...
✓ Successfully encrypted & pushed .env to remote (PRODUCTION)
```

## How encryption works

1. Generates a random 256-bit master key
2. Splits it into 5 Shamir shares (threshold: 3)
3. Derives an AES key from your lock key using PBKDF2 (100,000 iterations, SHA-256)
4. Encrypts the `.env` content with AES-256-GCM
5. Uploads the ciphertext + all 5 shares to the server

<Warning>
  The lock key is **not stored anywhere** by Enver. If you lose it, your secrets cannot be recovered. Store it securely (e.g., a password manager).
</Warning>

## Required token scope

Your API token must have `write:secrets` or `admin` scope.