Standardize how
your apps consume
secrets.

Stop reinventing secret loading in every project. Define one environment contract and resolve it everywhere.

Open-source secret resolution for AWS SSM and Azure Key Vault, across local development, CI/CD and application runtime.

AWS SSM · Azure Key Vault · GitHub Action · Runtime SDKs

❯ npm install -g envilder

# AWS CLI configured with permissions to SSM❯ aws sts get-caller-identity{    "UserId": "AROAADALOVELACE1815DC",    "Account": "123456789012",    "Arn": "arn:aws:sts::123456789012:assumed-role/secrets-role/ada.lovelace"} # Push each secret to SSM Parameter Store❯ npx envilder --push --key=OPENAI_API_KEY --value=example-not-a-real-secret --secret-path=/openai/prod/api-key 📤 PUSHING SECRET━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━  → OPENAI_API_KEY → *****************key ⭐ SECRET PUSHED  -  OPENAI_API_KEY=*******************secret → *****************key❯

AWS SSM

Azure Key Vault

GitHub Actions

npm

Why secret management is broken

Every team, every stage, every runtime handles secrets differently. No standard. No consistency. No confidence.

Fragmented across tools

Local dev uses .env files. CI/CD reads from vault integrations. Production has its own method. Same app, different configuration workflows everywhere.

Secrets shared through unsafe channels

API keys sent over Slack, .env files committed to repos, wiki pages with plain-text credentials. A security incident waiting to happen.

Configuration drift is inevitable

No single source of truth for what secrets an app needs. Dev, staging, and production desync. Deployments fail. Nobody knows which config is correct.

Why Envilder?

Envilder is a resolution layer over your existing secret manager. Secrets stay in your cloud. The JSON mapping is just the contract that keeps every environment consistent.

Zero Infrastructure

No servers, no proxies, no SaaS middleman. Built on AWS SSM and Azure Key Vault, services you already use and pay for.

One File, All Secrets

A single JSON contract defines every secret for every environment. Git-versioned, PR-reviewable, diff-able. Your team reviews secret changes in the same PR as the code.

Safe Secret Rotation

Rotate values in AWS SSM or Azure Key Vault without changing envilder.json. Existing generated .env files update only when you rerun Envilder; runtime consumers must restart or resolve again.

Your Secret Store, One Map Contract

Keep secrets in the AWS SSM or Azure Key Vault setup you already use. Envilder preserves the envilder.json mapping contract across tools; provider credentials and secret migration stay provider-specific.

Also included

GitHub ActionPull secrets in CI/CD workflows. Same mapping, zero manual intervention.

Bidirectional SyncPull to .env or push .env values back to your cloud provider via CLI.

Secrets Never Touch DiskRuntime SDKs load secrets directly into memory at app startup. No .env files written to disk.

Native IAM & RBACAWS IAM policies or Azure RBAC. No extra auth layer needed.

Provider-Native Access LogsCloudTrail or Azure Monitor can record provider access when configured. Envilder does not create an audit trail itself.

AWS Profile SupportSwitch between AWS CLI profiles for multi-account setups.

How it works

Define. Resolve. Ship.

STEP01

Define the mapping model

A JSON file mapping env var names to cloud secret paths. Commit it. Review it in PRs. Diff it between environments. One model for every stage and runtime.

envilder.jsonjson

{
  "DB_PASSWORD": "/my-app/prod/db-password",
  "API_KEY":     "/my-app/prod/api-key",
  "SECRET_TOKEN": "/my-app/prod/secret-token"
}

▼

STEP02

Resolve with the CLI

One command fetches every secret from your cloud vault and writes them to .env. Use it locally or in scripts. Same mapping, same behavior.

terminalbash

$ envilder --map=envilder.json --envfile=.env

✔ Fetched DB_PASSWORD  → ···word
✔ Fetched API_KEY      → ···key
✔ Fetched SECRET_TOKEN → ···oken
✔ Environment file written to .env

▼

STEP03

Load at runtime with SDKs

Skip the .env file entirely. Load secrets directly into your application at startup with native SDKs: Python, .NET, Node.js, and more.

AvailableView docs →📦 Package

pip install envilder

settings.pypython

from envilder import Envilder, SecretProviderType

# One-liner: load secrets into os.environ
Envilder.load("envilder.json")

# Or resolve as a dict without injecting
secrets = Envilder.resolve_file("envilder.json")

# Fluent builder with provider override
secrets = (
    Envilder.from_map_file("envilder.json")
    .with_provider(SecretProviderType.AZURE)
    .with_vault_url("https://my-vault.vault.azure.net")
    .inject()
)

AvailableView docs →📦 Package

dotnet add package Envilder

Program.cscsharp

using Envilder;

var builder = WebApplication.CreateBuilder(args);

// Load secrets into IConfiguration
builder.Configuration.AddEnvilder("envilder.json");

// Register EnvilderClient in DI
builder.Services.AddEnvilder("envilder.json");

// --- Or standalone (no ASP.NET) ---

// One-liner: resolve + inject into Environment
Env.Load("envilder.json");

// Fluent builder with provider override
Env.FromMapFile("envilder.json")
    .WithProvider(SecretProviderType.Azure)
    .WithVaultUrl("https://my-vault.vault.azure.net")
    .Inject();

AvailableView docs →📦 Package

npm install @envilder/sdk

config.tstypescript

import { Envilder, SecretProviderType } from '@envilder/sdk';

// One-liner: resolve + inject into process.env
await Envilder.load('envilder.json');

// Or resolve as a Map without injecting
const secrets = await Envilder.resolveFile('envilder.json');

// Fluent builder with provider override
const override = await Envilder.fromMapFile('envilder.json')
  .withProvider(SecretProviderType.Azure)
  .withVaultUrl('https://my-vault.vault.azure.net')
  .inject();

▼

STEP04

Push from dev to the vault

Need to add or rotate a secret? Push values from your local environment back to the cloud provider. No console needed.

terminalbash

$ envilder --push --envfile=.env --map=envilder.json

✔ Pushed DB_PASSWORD  → /my-app/prod/db-password
✔ Pushed API_KEY      → /my-app/prod/api-key
✔ Pushed SECRET_TOKEN → /my-app/prod/secret-token

▼

STEP05

Secrets stay in your vault

No intermediaries. Your cloud manages the storage, rotation, and access control. Envilder resolves. It never stores.

See it in action

Watch how Envilder simplifies secret management in under 2 minutes.

Demo command: envilder --map=envilder.json --envfile=.env. Envilder resolves mapped secrets from your configured cloud provider and writes the resulting variables to .env.

Your cloud. Your choice.

Envilder works today with AWS SSM Parameter Store and Azure Key Vault. GCP Secret Manager is planned and not available yet. Configure shipped providers in envilder.json or with CLI flags.

AWS SSM Parameter Store

envilder.jsonjson

{
  "$config": {
    "provider": "aws",
    "profile": "prod-account"
  },
  "DB_PASSWORD": "/my-app/prod/db-password",
  "API_KEY": "/my-app/prod/api-key"
}

$ envilder --map=envilder.json --envfile=.env

✔ Supports GetParameter with WithDecryption
✔ AWS Profile support for multi-account
✔ IAM policy-based access control
✔ CloudTrail access logging when configured

Azure Key Vault

envilder.jsonjson

{
  "$config": {
    "provider": "azure",
    "vaultUrl": "https://my-vault.vault.azure.net"
  },
  "DB_PASSWORD": "my-app-prod-db-password",
  "API_KEY": "my-app-prod-api-key"
}

$ envilder --provider=azure --vault-url=https://my-vault.vault.azure.net --map=envilder.json --envfile=.env

✔ Auto-normalizes secret names (slashes → hyphens)
✔ DefaultAzureCredential authentication
✔ Azure RBAC access control
✔ Azure Monitor access logging when configured

GCP Secret Manager

Planned

→ Planned GCP Secret Manager integration
→ Not available in the CLI, GitHub Action, or runtime SDKs

View roadmap →

Get started

Up and running in under a minute.

Prerequisites

Node.js v22.12+
Choose one cloud provider:
AWS SSM: AWS credentials with ssm:GetParameter; add ssm:PutParameter for --push
Azure Key Vault: Azure credentials with secret Get access; add Set access for --push

Install

npx

npm

pnpm

Quick start

Create an envilder.json mapping env vars to secret paths
Run npx envilder --map=envilder.json --envfile=.env
Your .env file is ready ✔

# Create mapping file$ echo '{"API_KEY": "/app/api-key"}'  > envilder.json # Push a secret$ npx envilder --push --key=API_KEY --value=example-not-a-real-secret --secret-path=/app/api-key

app.pypython

import os

from envilder import Envilder

Envilder.load("envilder.json")

# Secrets are now in os.environ
api_key = os.environ["API_KEY"]

View more examples on GitHub →

Standardize howyour apps consumesecrets.

Why secret management is broken

Fragmented across tools

Secrets shared through unsafe channels

Configuration drift is inevitable

Why Envilder?

Zero Infrastructure

One File, All Secrets

Safe Secret Rotation

Your Secret Store, One Map Contract

Also included

How it works

Define the mapping model

Resolve with the CLI

Load at runtime with SDKs

Push from dev to the vault

Secrets stay in your vault

See it in action

Your cloud. Your choice.

AWS SSM Parameter Store

Azure Key Vault

GCP Secret Manager

Get started

Prerequisites

Install

Quick start

Standardize how
your apps consume
secrets.