Keys are generated when environments are created; you do not need to fetch the key every time. That means if you are using your CI keys for Github and CircleCI, you will use the same key for both.

Unfortunately, this also means if you have a breach, you will have to rotate keys for every service using the environment key. Keep track of this list of services somewhere else, like on Confluence or somewhere outside your code repository, to minimize potential damage. That way, when you rotate the keys, you can switch them all out easily, and attackers won't be able to take the whole list and break all of those services.

---
title: How to Share Environment Variables with Your Team
privateVideoUrl: https://stream.mux.com/9P7mbCLmDaMYwPXHo2BU01ZdZ4RsrMrxfsOXM3IsjXVU.m3u8
isPublicLesson: true
code: https://gitlab.com/fullstackio/books/newline-course-apps/environment-variables-for-web-developers-app/-/tree/main/code/module_02/lesson_02.03/App?ref_type=heads
---

[Dotenv Vault](https://www.dotenv.org/docs#getting-started)

## Supplementary

### Files

-   `.env.me`:

    -   private vault session file

        -   If you don't understand how cookies or auth tokens work, it's a secure identifier that makes sure you don't have to log in with your password every time you need to hit the remote server.
        -   unique per machine AND repo
    -   gitignored
    -   created with the vault login command within the local repo
-   `.env.vault`:

    -   public vault project identifier
    -   committed to git
    -   created with the vault new command
-   `.env`:

    -   holds secret values
    -   works like a regular `.env` file within your project
    -   pulling updates from remote
    -   pushing updates remotely from it
    -   refers to the primary environment set

### Rotate keys

Keys are generated when environments are created; you do not need to fetch the key every time. That means if you are using your CI keys for Github and CircleCI, you will use the same key for both.

Unfortunately, this also means if you have a breach, you will have to rotate keys for every service using the environment key. Keep track of this list of services somewhere else, like on Confluence or somewhere outside your code repository, to minimize potential damage. That way, when you rotate the keys, you can switch them all out easily, and attackers won't be able to take the whole list and break all of those services.

Kemal Ahmed

How to Share Environment Variables with Your Team

When you work in a team, you need to share your environment variables with them

The best thing to do is only give them the minimum they need until they need

That is, you only need to give them the development settings and not production

The most secure way to do this typically is in person or on the phone.

You can also send the values over a secure message platform,

but the best way to share your development environment variables is using a key

.envault allows you to control which environments users can access.

Update them if things change and take away that access in a secure way.

Although you can already set the values for the environment variables through

their respective dashboards for each service,

there is also a way to automate inserting the values into your test and

This eliminates the need for .env flow since you already can switch between the

If you want to change the local values, you can just set the values in your .

Before I set up my vault, I like to set up my package JSON scripts.

I like to add the common commands that I use, and I've added a few extra ones

We'll go over a lot of these commands, build, new, push, pull, login.

But for now, I'll just leave them there before I explain them all.

To do that, we'll use the vault new command.

This will create a new repo on the vault servers, and if you have a .env file

it'll use those values to initialize your vault.

Let's go run that now. npm run vault new.

This creates a .env.vault file as you see, which is a public vault project

The command also tries to send you to the vault website.

But if that fails, you can click the link manually.

So we'll just have to login and then step three will be open.

It's a little bit weird because you log into the account after you create your

But that's how it works because that's how you get your session token.

You'll notice this creates a .env.me file, which is a private vault session

For me, the link didn't work again, so I had to menu and click it, but that

If you don't understand how cookies or auth tokens work, it's a secure

identifier that makes sure you don't have to login with your password

every time you need to hit the remote server.

Next, if you want to make changes to your vault, you need to know push.

So push will push your values that you've written in dot end into the vault.

There's also a vault open command, but I didn't include it in my commands that

you need to know because it just opens the vault project page in your browser

You can still access the project page on the vault website.

As you can see, your dot end file holds your secret values, like regular dot

end file, and it so works like a regular dot end file within your project.

Pulling will update it from remote and pushing will update remote from it.

Dot end also, this file refers to the primary environment set.

That is, you can have multiple environment sets as you please.

However, additional environment sets are not created by default.

By default, you have a single primary environment set called development.

And if you want more, so in this case, we can have a CI set, we have to push

As you see, there's an error. It says mission and file.

That's because we don't have an dot end dot CI file.

We'll save an empty file as dot end dot CI.

Now, let's see what happens when we do that.

The next thing that you should know is how to sync your dot end vault your

So I'm actually going to delete the dot end CI and dot end files.

So the first thing that we have to do is log in.

We've already done that. We have our dot me.

And then what we do is we do vault pull and pm run vault pull.

And it will log in and it will download the dot end file.

If you do not have your dot end dot vault file, you can use vault build and pm

This will create the individual session identifiers.

It is run automatically every time that pulls run, but it's a good idea to

which at any time there's any issues with it.

When you want to deploy the environment set to your server or to your CI, you

The dot end key is an additional security measure that you can use or that you

have to use that helps you access your dot end files from a separate server.

So to do that, I'm going to make another command dot end keys and we're going

Learn

The newline Guide to Building Your First GraphQL Server with Node and TypeScript

Teach

Amelia Wattenberger

Author of Fullstack D3

Community

Masterclasses

Tutorials

Fullstack React with TypeScript