local file.env.localnever committed
Encrypted dotenv sync for teams that know better
Stop pasting secrets like it is normal.
Keyit moves environment files between approved developer machines. Chat is not a vault. Git is not a vault. That shared doc is definitely not a vault.
keyit workspace
init
$ keyit initadd
$ keyit env add dev .env.localpush
$ keyit push --env devpull
$ keyit pull --env devuntrusted relayrev 014moves, never reads
approved devicedeveloper-bpulls deliberately
environmentdev
statussynced
printsnames only
relay seesciphertext and metadata
cli printskeys, ids, paths
trust lives inapproved devices
The line
Secrets need a protocol, not a gentleman's agreement.
Keyit is small on purpose. It is not your cloud secret manager, your developer portal, or some enterprise ceremony wearing a CLI costume. It gives project-local private state a repeatable path with hard trust boundaries.
Revision ledger
The relay is transport. Do not worship it.
Every push creates a signed environment revision. The relay can store it, order it, and serve it back. It still cannot decrypt the useful part.
revisiondevicesummaryrelay sees
rev 014developer-astaging env update
ciphertext onlyrev 013developer-bwebhook key rotation
ciphertext onlyrev 012developer-alocal flags synced
ciphertext onlyHard boundaries
A small tool that says no at the right time.
Plaintext stays local
Values are sealed before upload. If the relay can read them, the tool has already failed.
Trust machines, not vibes
Access is a device decision: invite it, approve it, revoke it when the laptop should stop receiving state.
Refusals are a feature
Pull will not overwrite local changes by accident. Push will not pretend a stale base is fine.
The working loop
Four commands instead of a security theatre meeting.
Commit the map
Keep project metadata in Git. Keep environment values out of it.
Approve the machine
A teammate gets state only after their device joins and an owner approves it.
Push sealed state
The relay carries revisions. It does not get promoted into your secrets authority.
Inspect without leaking
Status and diff show drift and key names, not the private values your team is trying to protect.
Documentation map
Read the part that can hurt you first.
Hosted or self-hosted
Use our relay if you need the cheap path. Run your own damn relay if you need control.
The hosted relay is for speed and small teams. Self-hosting is for policy, budget, audits, and people who do not want another vendor-shaped dependency. The protocol is the same either way.