v0.9.2 Open Source · MIT

One model.
Your secrets.
Every runtime.

Define secret mappings once and resolve them consistently from AWS SSM, Azure Key Vault or GCP Secret Manager — locally with the CLI, in CI/CD with the GitHub Action, or at app startup with runtime SDKs.

▶ Get Started ★ View on GitHub

 $ npm install -g envilder

   # 1. One mapping model for every environment   $  cat  param-map.json   {    "DB_PASSWORD": "/app/prod/db-pass",    "API_KEY":     "/app/prod/api-key"   }     # 2. Resolve secrets with the CLI   $  envilder  --map =param-map.json  --envfile =.env     ✔  Fetched DB_PASSWORD → ···pass   ✔  Fetched API_KEY     → ···key   ✔  Environment file written to .env     $    

AWS SSM

Azure Key Vault

GitHub Actions

npm

Why secret management is broken

Every team, every stage, every runtime handles secrets differently. No standard. No consistency. No confidence.

💀

Fragmented across tools

Local dev uses .env files. CI/CD reads from vault integrations. Production has its own method. Same app, different configuration workflows everywhere.

📨

Secrets shared through unsafe channels

API keys sent over Slack, .env files committed to repos, wiki pages with plain-text credentials. A security incident waiting to happen.

🐌

Configuration drift is inevitable

No single source of truth for what secrets an app needs. Dev, staging, and production desync. Deployments fail. Nobody knows which config is correct.

▼ envilder fixes this ▼

🛡️

One model, one source of truth

A single mapping file defines what secrets your app needs. Git-versioned. PR-reviewable. The same contract across every environment.

⚡

Consistent resolution everywhere

CLI for local dev, GitHub Action for CI/CD, runtime SDKs for app startup. Same mapping, same behavior, same result.

🤖

Your cloud, no middleman

AWS SSM, Azure Key Vault, or GCP. No SaaS proxy. Secrets stay in your infrastructure. Native IAM/RBAC access control.

Built for real teams

A configuration resolution system designed for security, consistency, and multi-runtime execution.

📋

Single Mapping Model

One JSON contract defines all secrets. Git-versioned, PR-reviewable, diff-able across environments. The model is the product.

🔌

Runtime SDKs

Load secrets directly into memory at app startup — Python, .NET, TypeScript, Go, Java. No .env files written to disk. No secrets left behind.

☁️

Multi-Provider

AWS SSM, Azure Key Vault, and GCP Secret Manager (coming soon). Your cloud, your rules. No vendor lock-in.

⚙️

GitHub Action

Pull secrets in CI/CD workflows. Same mapping, zero manual intervention. Drop-in integration.

🔄

Bidirectional Sync

Pull secrets to .env files or push .env values back to your cloud provider. Full round-trip support via CLI.

🔒

IAM & RBAC Access

Native cloud access control. AWS IAM policies or Azure RBAC define who reads what. No extra auth layer.

📊

Fully Auditable

Every read and write is logged in AWS CloudTrail or Azure Monitor. Complete trace of who accessed what and when.

🧱

Zero Infrastructure

No servers, no proxies, no SaaS. Built on native cloud services you already use and pay for.

👤

AWS Profile Support

Multi-account setups? Use --profile to switch between AWS CLI profiles. Perfect for multi-stage environments.

How it works

Define. Resolve. Ship.

STEP 01

Define the mapping model

A JSON file mapping env var names to cloud secret paths. Commit it. Review it in PRs. Diff it between environments. One model for every stage and runtime.

param-map.json json

{
  "DB_PASSWORD": "/my-app/prod/db-password",
  "API_KEY":     "/my-app/prod/api-key",
  "SECRET_TOKEN": "/my-app/prod/secret-token"
}

▼

STEP 02

Resolve with the CLI

One command fetches every secret from your cloud vault and writes them to .env. Use it locally or in scripts. Same mapping, same behavior.

terminal bash

$ envilder --map=param-map.json --envfile=.env

✔ Fetched DB_PASSWORD  → ···word
✔ Fetched API_KEY      → ···key
✔ Fetched SECRET_TOKEN → ···oken
✔ Environment file written to .env

▼

STEP 03

Load at runtime with SDKs

Skip the .env file entirely. Load secrets directly into your application at startup with native SDKs — Python, .NET, TypeScript, and more.

settings.py python

from envilder import Envilder

# One-liner: load secrets into os.environ
Envilder.load("param-map.json")

# Or resolve as a dict without injecting
secrets = Envilder.from_file("param-map.json").resolve()

Program.cs csharp

using Envilder;

// Load into IConfiguration
builder.Configuration.AddEnvilder("param-map.json");

// Or resolve + inject into environment
var client = new EnvilderClient();
var parsed = MapFileParser.Parse("param-map.json");
var secrets = await client.ResolveSecretsAsync(parsed);
EnvilderClient.InjectIntoEnvironment(secrets);

▼

STEP 04

Push from dev to the vault

Need to add or rotate a secret? Push values from your local environment back to the cloud provider. No console needed.

terminal bash

$ envilder --push --envfile=.env --map=param-map.json

✔ Pushed DB_PASSWORD  → /my-app/prod/db-password
✔ Pushed API_KEY      → /my-app/prod/api-key
✔ Pushed SECRET_TOKEN → /my-app/prod/secret-token

▼

STEP 05

Secrets stay in your vault

No intermediaries. Your cloud manages the storage, rotation, and access control. Envilder resolves — it never stores.

See it in action

Watch how Envilder simplifies secret management in under 2 minutes.

Your cloud. Your choice.

Envilder works with AWS SSM Parameter Store, Azure Key Vault, and GCP Secret Manager (coming soon). Configure inline or via CLI flags.

AWS SSM Parameter Store

param-map.json json

{
  "$config": {
    "provider": "aws",
    "profile": "prod-account"
  },
  "DB_PASSWORD": "/my-app/prod/db-password",
  "API_KEY": "/my-app/prod/api-key"
}

 $ envilder --map=param-map.json --envfile=.env

✔ Supports GetParameter with WithDecryption
✔ AWS Profile support for multi-account
✔ IAM policy-based access control
✔ CloudTrail audit logging

Azure Key Vault

param-map.json json

{
  "$config": {
    "provider": "azure",
    "vaultUrl": "https://my-vault.vault.azure.net"
  },
  "DB_PASSWORD": "my-app-prod-db-password",
  "API_KEY": "my-app-prod-api-key"
}

 $ envilder --provider=azure --vault-url=https://my-vault.vault.azure.net --map=param-map.json --envfile=.env

✔ Auto-normalizes secret names (slashes → hyphens)
✔ DefaultAzureCredential authentication
✔ Azure RBAC access control
✔ Azure Monitor audit logging

GCP Secret Manager

Coming soon

param-map.json json

{
  "$config": {
    "provider": "gcp",
    "projectId": "my-project-id"
  },
  "DB_PASSWORD": "my-app-prod-db-password",
  "API_KEY": "my-app-prod-api-key"
}

 $ envilder --provider=gcp --map=param-map.json --envfile=.env

✔ Google Cloud Secret Manager integration
✔ Application Default Credentials (ADC)
✔ IAM-based access control
✔ Cloud Audit Logs

Runtime SDKs

Load secrets directly into your application at startup. No .env files, no intermediaries — just your cloud vault and your code.

🐍

Python

Available

Load secrets with one line. Supports AWS SSM and Azure Key Vault.

pip install envilder

View docs → 📦

🟣

.NET

Available

Native IConfiguration integration. Resolve secrets at startup.

dotnet add package Envilder

View docs → 📦

🔵

Go

Planned

Lightweight secret loading for Go services.

☕

Java

Planned

Spring Boot and standalone Java support.

GitHub Action

Pull secrets at deploy time. Drop it into any workflow in minutes.

☁️ AWS SSM

.github/workflows/deploy.yml yaml

- name: 🪙 Configure AWS Credentials
  uses: aws-actions/configure-aws-credentials@v6
  with:
    role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
    aws-region: us-east-1

- name: 🔐 Pull Secrets from AWS SSM
  uses: macalbert/envilder/github-action@v0
  with:
    map-file: param-map.json
    env-file: .env

🔑 Azure Key Vault

.github/workflows/deploy.yml yaml

- name: 🔑 Azure Login
  uses: azure/login@v2
  with:
    client-id: ${{ secrets.AZURE_CLIENT_ID }}
    tenant-id: ${{ secrets.AZURE_TENANT_ID }}
    subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}

- name: 🔐 Pull Secrets from Azure Key Vault
  uses: macalbert/envilder/github-action@v0
  with:
    map-file: param-map.json
    env-file: .env
    provider: azure
    vault-url: ${{ secrets.AZURE_KEY_VAULT_URL }}

Action inputs

Input	Required	Description
`map-file`	Yes	Path to JSON file mapping env vars to secret paths
`env-file`	Yes	Path to .env file to generate
`provider`	No	Cloud provider: aws or azure (default: aws)
`vault-url`	No	Azure Key Vault URL

Output: env-file-path — Path to the generated .env file

What's new

Latest release highlights. Documentation website is live.

v0.9.2

Documentation & Stability

March 30, 2026

✨ Documentation website launched at envilder.com — full guides, changelog, and multi-language docs
✨ Fixed: @types/node moved to devDependencies — no runtime bloat in installs
✨ Fixed: e2e test flakiness — unique SSM paths per test run prevent race conditions

What's next

Envilder is actively developed. Here's where we're headed.

✅

Pull secrets to .env

Map env var names to cloud secret paths via JSON and generate .env files automatically

✅

Push mode (--push)

Upload .env values or single secrets to cloud provider

✅

GitHub Action

Use Envilder in CI/CD workflows natively

✅

Multi-provider (AWS + Azure)

AWS SSM Parameter Store and Azure Key Vault support

📖

Documentation website

Dedicated docs site with guides, examples, API reference

✅

Python SDK (envilder)

Runtime library for Django/FastAPI/data pipelines. Published to PyPI

✅

.NET SDK (Envilder)

Runtime library for enterprise apps and Azure-native shops. Published to NuGet

📦

TypeScript SDK (@envilder/sdk)

Up next

Native runtime library — load secrets directly into process.env from a map-file. Published to npm

🐹

Go SDK (envilder)

Up next

Runtime library for cloud-native apps and Kubernetes tooling. Published as Go module

☕

Java SDK (envilder)

Up next

Runtime library for Spring Boot and Android backends. Published to Maven Central

⚡

Exec mode (--exec)

Inject secrets into child process without writing to disk

☁️

GCP Secret Manager

Third cloud provider — completes the multi-cloud trident

🔐

AWS Secrets Manager

Support JSON-structured secrets alongside SSM Parameter Store

✔️

Check/sync mode (--check)

Validate cloud secrets vs local .env — fail CI if out-of-sync

Get started

Up and running in under a minute.

Prerequisites

Node.js v20+
AWS CLI configured (for AWS SSM)
Azure CLI configured (for Azure Key Vault)
IAM permissions: ssm:GetParameter / ssm:PutParameter

Install

pnpm pnpm add -g envilder

npm npm install -g envilder

npx npx envilder --help

Quick start

Create a param-map.json mapping env vars to secret paths
Run envilder --map=param-map.json --envfile=.env
Your .env file is ready ✔

   # Install globally   $  npm install -g envilder     # Create mapping file   $  echo  '{"API_KEY": "/app/api-key"}'   > param-map.json     # Pull secrets   $  envilder  --map =param-map.json  --envfile =.env     ✔  Done! .env file generated.     # Push a secret   $  envilder  --push  --key =API_KEY  --value =sk_live_abc123  --secret-path =/app/api-key     ✔  Secret pushed successfully.   

One model. Your secrets. Every runtime.

Why secret management is broken

Fragmented across tools

Secrets shared through unsafe channels

Configuration drift is inevitable

One model, one source of truth

Consistent resolution everywhere

Your cloud, no middleman

Built for real teams

Single Mapping Model

Runtime SDKs

Multi-Provider

GitHub Action

Bidirectional Sync

IAM & RBAC Access

Fully Auditable

Zero Infrastructure

AWS Profile Support

How it works

Define the mapping model

Resolve with the CLI

Load at runtime with SDKs

Push from dev to the vault

Secrets stay in your vault

See it in action

Your cloud. Your choice.

AWS SSM Parameter Store

Azure Key Vault

GCP Secret Manager

Runtime SDKs

Python

.NET

Go

Java

GitHub Action

☁️ AWS SSM

🔑 Azure Key Vault

Action inputs

What's new

Documentation & Stability

What's next

Pull secrets to .env

Push mode (--push)

GitHub Action

Multi-provider (AWS + Azure)

Documentation website

Python SDK (envilder)

.NET SDK (Envilder)

TypeScript SDK (@envilder/sdk)

Go SDK (envilder)

Java SDK (envilder)

Exec mode (--exec)

GCP Secret Manager

AWS Secrets Manager

Check/sync mode (--check)

Get started

Prerequisites

Install

Quick start

One model.
Your secrets.
Every runtime.