Secrets

A developer secrets vault. Organize secrets as Project, Environment, and Secret, and pull an environment into your app at launch, across every machine, with optional end-to-end encryption.

Secrets#

Secrets is a developer vault for your environment variables and credentials. You organize them as Project -> Environment -> Secret, then pull an environment into your app at launch, on every machine, from one account. No more copying .env files around. Projects can optionally be end-to-end encrypted, so not even Hep.gg can read their values.

Concepts#

Quick start#

1. Open Dashboard -> Secrets and create a project.
2. Add a secret: type a NAME, fill its value under one or more environments, and the checkmark saves it instantly.
3. Open the Pull Tokens tab and create a token.
4. In your app:

npm install hepgg-secrets --registry https://npm.hep.gg

import { config } from "hepgg-secrets";
 
await config({
  env: "production",
  token: process.env.HEPGG_SECRETS_TOKEN,
});
// your secrets are now in process.env

Every time your app starts it pulls the latest values. Edit a value in the dashboard and the next launch picks it up. See the pull API and the hepgg-secrets package for details.

Importing existing config#

The dashboard's Import tab accepts:

• .env files (KEY=value, quotes and export handled).
• .json (nested objects are flattened, e.g. db.host becomes DB_HOST).
• pm2 ecosystem config.json (each app's env block becomes an importable group).

Paste or upload the file, pick which variables to import, choose the target environment, and commit. Existing names can be overwritten or skipped.

Copying between environments#

The Copy environment button duplicates every secret from one environment into another within the same project, the fast way to seed production from development.

End-to-end encryption#

When you create a project you can turn on end-to-end encryption. Values are then encrypted in your browser with a passphrase Hep.gg never sees; we store only ciphertext. You also get a one-time recovery key, save it, because if you lose both the passphrase and the recovery key, the data is unrecoverable.

To pull an E2EE project, give the package your key (see the pull API). E2EE is chosen when the project is created and cannot be switched later.

Plans#