envault

Opening your workspace…

A safer home for every variable.

One workspace for your company’s domains, configuration, and secrets.

APP_ENV = production

ADMIN_ENABLED = true

API_SECRET = ••••••••••••

MAGNIFY BRAND / PRIVATE WORKSPACE

envaultTEAM

YOUR PRIVATE WORKSPACE

Welcome back.

Admin emailPassword

One administrator. Everything under control.

envaultTEAM

Magnify BrandCompany workspace

⌄

WORKSPACE

Private by design

Your configuration stays in your company’s workspace.

Magnify BrandSingle administrator

Workspace / Environment variables

Admin sessionMB

MAGNIFY BRAND / CONFIGURATION

Environment variables

Your company configuration, securely managed.

Total variables 0

In the selected environment

Domains 0

Company websites

Secret values 0

Encrypted & masked

Hidden variables 0

Excluded from the editor

Configuration, under control. Encrypted server storage

Add variable

Define a value for the selected domain and environment. All values are encrypted before storage.

Variable nameValue typeValue Hide from visual editor

Hidden variables stay in your configuration and can be managed using the Hidden filter.

Add company domain

Use a domain or subdomain your company controls.

Hostname

You will receive a TXT record to verify DNS ownership. Website traffic stays with its current host.

Backend connection

Copy these credentials now. The integration key will not be shown again. Keep them only in your website’s server environment.

EndpointENVAULT_TOKEN

ENVAULT_GATEWAY_TOKEN

This private deployment also requires the gateway token in the OAI-Sites-Authorization header.

GET the endpoint with Authorization: Bearer ENVAULT_TOKEN. Read the returned values object. Use the load-env.php example included with this package. Create a replacement key before the 90-day expiry.

Delete domain?

This permanently deletes , its saved variables, and connection keys from Envault. The website’s own .env file is not deleted. Remove its connector script separately to disable access there. This cannot be undone.

Type the domain name to confirm

Connect website .env

Read, create, and edit the actual .env file on .

Verify domain ownership
Add and verify the domain’s TXT record in Envault.
Install the PHP connector
Download envault-connector.php and upload it to the website’s public_html. The website’s .env can be in public_html or one level above it.
Add a private connector token
Generate a token and add the line below to that website’s .env. Do not add it to browser code.

Back up the website’s original .env first. The connector preserves other entries and comments, and rejects saves if the file changed since your last fetch. PHP 8.2+ is required. If .env is inside public_html, block its public download with the protection rule provided in the project.

.env protection rule for public_html

Merge this into the connected website’s existing .htaccess. Keep its other routing rules.

<FilesMatch "(?i)^\.env(?:\..*)?$">
 Require all denied
</FilesMatch>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]