stash env
Mint deployment credentials and print them as env vars
Generated from stash v1.0.0 via npx [email protected] manifest --json. Run npx [email protected] --help to see the live command surface.
Mints a fresh ZeroKMS client and a CipherStash access key from your
device-code session (stash auth login), then prints the four env
vars a deployed app needs: CS_WORKSPACE_CRN, CS_CLIENT_ID,
CS_CLIENT_KEY, CS_CLIENT_ACCESS_KEY.
The access key is created with the member role (the CLI never mints admin keys) and is shown exactly once — pipe the output into your deployment secret store. Creating access keys requires your user to have the admin role in the workspace.
Stdout carries only the dotenv block (or the --json events);
progress UI goes to stderr, so stash env --name x > prod.env
and pipes into secret stores are safe.
npx stash env [flags]Flags
| Flag | Description |
|---|---|
--name <name> | Name for the minted access key and ZeroKMS client. Prompted for interactively; required in non-interactive runs. |
--write [path] | Write the vars to a file (default .env.production.local, mode 0600) instead of printing them. An existing file prompts before overwriting — and is refused non-interactively — before anything is minted. |
--json | Emit machine-readable NDJSON (a { status: "minted" } object, or { status: "written" } with --write — deliberately secret-free since the secrets are in the file; failures are { status: "error" }). Implies no prompts. |
Examples
npx stash env --name my-app-prod
npx stash env --name my-app-prod --write
npx stash env --name staging --write .env.staging.local
npx stash env --name edge-dev --json