# xecret

> Open-source secret management for developers. Store environment variables once, encrypted per environment, and inject them into any process — locally, in CI, in production — without writing a .env file to disk.

Every page below is published twice: as HTML at the path shown, and as the markdown it was written in at the same path with `.md` appended. The links here point at the markdown.

The whole documentation set concatenated into one file: https://xecret-staging.playxoft.com/llms-full.txt

If you are an agent about to work with xecret rather than answer one question about it, read the skill instead: https://xecret-staging.playxoft.com/skill.md. It is one page covering the commands, the scoping rules, the CI story, the errors, and the conventions this tool expects an agent to respect. The pages below are what it defers to for detail.

## Getting started

- [What is xecret?](https://xecret-staging.playxoft.com/docs/what-is-xecret.md): A plain-English explanation of the problem xecret solves, who it is for, and how it compares to keeping a .env file.
- [Quickstart](https://xecret-staging.playxoft.com/docs/quickstart.md): From sign-up to running your app with injected secrets in about five minutes, including your first CI job.
- [Core concepts](https://xecret-staging.playxoft.com/docs/concepts.md): Organisations, projects, environments, secrets, versions and tokens — the vocabulary every other page assumes, defined once.
- [Installing the CLI](https://xecret-staging.playxoft.com/docs/install.md): Install the xecret command-line tool on macOS, Linux, Windows, from npm, in Docker and in CI — with checksum verification and upgrade instructions.

## The CLI

- [The xecret CLI](https://xecret-staging.playxoft.com/docs/cli.md): What the command-line tool does, the two rules it never breaks, how output is split between stdout and stderr, and where to find each command.
- [CLI command reference](https://xecret-staging.playxoft.com/docs/cli/commands.md): Every xecret command and flag — login, init, projects, secrets, versions, import, pull, export, run, audit, tokens and cache — with examples and the exact behaviour of each.
- [Configuration and scope](https://xecret-staging.playxoft.com/docs/cli/configuration.md): How the CLI decides which project and environment you mean, the .xecret.yaml format, every environment variable, and where credentials are stored.
- [The offline cache](https://xecret-staging.playxoft.com/docs/cli/offline-cache.md): How xecret keeps working when the network does not — what the encrypted local cache stores, exactly when it answers, and why a revoked credential is never softened by it.

## Guides

- [xecret with Next.js](https://xecret-staging.playxoft.com/docs/guides/nextjs.md): Replace .env.local with xecret in a Next.js app — local development, NEXT_PUBLIC build-time variables, multiple environments, and deployment.
- [xecret with Node.js](https://xecret-staging.playxoft.com/docs/guides/nodejs.md): Use xecret in any Node project — npm scripts, dotenv removal, TypeScript, monorepos, tests, and reading configuration safely at startup.
- [xecret with React and Vite](https://xecret-staging.playxoft.com/docs/guides/react-vite.md): Use xecret with a Vite front end — the VITE_ prefix, why browser configuration is never secret, and where the real credentials belong instead.
- [xecret with Go](https://xecret-staging.playxoft.com/docs/guides/go.md): Use xecret in a Go project — go run and go test under injected secrets, reading configuration at startup, and building static binaries in CI.
- [xecret with Docker](https://xecret-staging.playxoft.com/docs/guides/docker.md): Keep secrets out of image layers — runtime injection, BuildKit secret mounts, Compose, and the export format that exists only for docker run.
- [Secrets in CI/CD](https://xecret-staging.playxoft.com/docs/guides/ci.md): Service tokens end to end — GitHub Actions, GitLab CI, CircleCI and generic runners — with scoping, rotation and the one anti-pattern to avoid.
- [Importing and exporting secrets](https://xecret-staging.playxoft.com/docs/guides/import-export.md): Move secrets in and out of xecret — .env, JSON, YAML and shell formats, conflict strategies, dry runs, and migrating from another secret manager.
- [Teams, roles and access](https://xecret-staging.playxoft.com/docs/guides/teams.md): Invite people, choose roles, grant access per project and environment, and understand why production is denied by default to developers.

## Environments and policies

- [Secret references and environment inheritance](https://xecret-staging.playxoft.com/docs/features/references.md): Build one secret from others with ${env.KEY} templates, and let an environment inherit from a parent — resolved on your machine, never on our servers.
- [Personal overrides](https://xecret-staging.playxoft.com/docs/features/overrides.md): Use your own value for one secret on your machine — a local database instead of staging's — without changing the environment anyone else reads, or any CI run.
- [Environment promotion and point-in-time restore](https://xecret-staging.playxoft.com/docs/features/promotion-and-restore.md): Promote values from staging to production with a masked diff, and put an environment back the way it was at an earlier moment — atomically, and without losing history.
- [Webhooks on secret change](https://xecret-staging.playxoft.com/docs/features/webhooks.md): Get a signed HTTPS call when a secret is created, changed, rotated or deleted, or an environment is promoted or restored. Payloads carry names, never values.
- [Policies and new-address read alerts](https://xecret-staging.playxoft.com/docs/features/policies.md): Require IP allowlists and short lifetimes on tokens, enforce secret naming and strength rules, disable plaintext export, and get told when a new address reads production.

## HTTP API

- [HTTP API overview](https://xecret-staging.playxoft.com/docs/api.md): The contract the dashboard, CLI and CI all speak — authentication, request shape, error codes, pagination, rate limits and CSRF.
- [API endpoint reference](https://xecret-staging.playxoft.com/docs/api/reference.md): Every HTTP endpoint — auth, organisations, projects, environments, secrets, bulk read, import and export, members, tokens and the audit log.
- [Tokens and credentials](https://xecret-staging.playxoft.com/docs/api/tokens.md): Sessions, CLI tokens and service tokens — what each can do, how they are scoped and stored, how to rotate them, and what happens when one leaks.

## Security

- [What xecret can and cannot see](https://xecret-staging.playxoft.com/docs/security/trust-model.md): The encryption model stated plainly — envelope encryption, the key hierarchy, what a database breach yields, and when you should choose a zero-knowledge product instead.
- [The audit log](https://xecret-staging.playxoft.com/docs/security/audit-log.md): Every event xecret records, what each one means, how to filter the log, and how to use it during an incident when a credential has leaked.
- [Resetting your vault, the archive, and the seven-day window](https://xecret-staging.playxoft.com/docs/security/vault-archive.md): What happens when you reset a vault you cannot open — the emailed archive and its risk, the seven days to recover, and how to import or open the archive offline.

## Running it yourself

- [Self-hosting xecret](https://xecret-staging.playxoft.com/docs/self-hosting.md): Run xecret yourself — the honest dependency list, the root-key ceremony, a step-by-step deployment, and what you are signing up to operate.

## Reference

- [Troubleshooting](https://xecret-staging.playxoft.com/docs/troubleshooting.md): Every error message the CLI and API produce, what it actually means, and the fix — from "command not found" to "no such environment" in CI.
- [Frequently asked questions](https://xecret-staging.playxoft.com/docs/faq.md): Short answers about pricing, security, offline use, team access, migrating away, self-hosting and how xecret compares to .env files and other tools.
- [Using xecret with AI agents](https://xecret-staging.playxoft.com/docs/ai-agents.md): The one-line skill install for Claude, ChatGPT, Gemini and every other coding agent, the machine-readable documentation endpoints, and letting an agent run your app without production credentials.

## Blog

- [Stop committing .env files: how to get secrets out of your repository without slowing your team down](https://xecret-staging.playxoft.com/blog/stop-committing-env-files.md): The .env file is a default, not a discipline problem. Why copies escape .gitignore, the four ways it actually goes wrong, and a migration you can do today.
- [Next.js environment variables: what NEXT_PUBLIC_ really does, and the three ways secrets end up in the browser bundle](https://xecret-staging.playxoft.com/blog/nextjs-environment-variables-guide.md): The inlining model for the App Router: build time versus runtime, which .env file wins, the server-only boundary, and how to grep what actually shipped.
- [There is an API key in your git history. Here is how to find it, and what to do in the ninety minutes after you do.](https://xecret-staging.playxoft.com/blog/find-leaked-api-keys-in-git-history.md): A key deleted in a later commit is still live and still readable. How to find secrets in git history, plus the rotate-first runbook that keeps production up.
- [Your CI pipeline is the softest target you own: a practical guide to secrets in CI/CD](https://xecret-staging.playxoft.com/blog/secrets-in-ci-pipelines.md): CI holds production credentials, runs code from pull requests, and writes logs half the company can read. The failure modes that leak secrets, and the fixes.
- [Envelope encryption, zero-knowledge, or plain trust: how to read a secret manager's security page](https://xecret-staging.playxoft.com/blog/how-secret-managers-encrypt-your-secrets.md): Every secret manager encrypts your data. Only some cannot read it. How envelope encryption works, what zero-knowledge really costs, and the questions to ask.
- [How to rotate a secret without taking production down](https://xecret-staging.playxoft.com/blog/rotate-secrets-without-downtime.md): Rotation is avoided because it is a distributed change, not a hard one. The overlap pattern, finding every consumer first, and what to do without overlap.

## Optional

- [Features](https://xecret-staging.playxoft.com/features): what the product does, in detail.
- [Pricing](https://xecret-staging.playxoft.com/pricing): plans, limits and what each tier includes.
- [FAQ](https://xecret-staging.playxoft.com/faq): the questions asked before signing up.
- [About](https://xecret-staging.playxoft.com/about): why this exists and what it commits to.
- [Privacy policy](https://xecret-staging.playxoft.com/privacy) and [Terms](https://xecret-staging.playxoft.com/terms).