MyCLI

Secrets

Secrets & environment sync

MyCLI can sync local .env values to cloud secret stores and optionally load them at runtime.

CLI

# Plan / sync (deploy-time)
my deploy secrets sync --provider railway --dry-run
my deploy secrets sync --provider aws-sm
my deploy secrets sync --provider vault

# Generate docs + runtime loader
# (also runs as part of `my deploy setup --provider …`)

Providers

| Provider | Backend | |----------|---------| | railway / fly / vercel / netlify / render / digitalocean | PaaS CLI | | aws | AWS SSM Parameter Store | | aws-sm | AWS Secrets Manager | | vault | HashiCorp Vault KV | | gcp | Google Secret Manager | | azure | Azure Key Vault |

Runtime loader

Generated file: src/config/load-secrets.ts

import { loadSecrets } from './config/load-secrets.js';

await loadSecrets(); // SECRETS_RUNTIME_PROVIDER=aws-sm|vault|gcp|azure

For GCP, set GCP_PROJECT_ID and optionally GCP_SECRET_ID (JSON object of env vars). For Azure, set AZURE_KEY_VAULT_NAME and optionally AZURE_SECRET_NAME (JSON secret).

Related