Environments & Secrets

LPM CLI keeps project environment variables in a local encrypted vault. LPM.dev Registry adds cloud sync, browser access, organization sharing, deployment-platform connections, and policy-controlled CI access.

lpm env set DATABASE_URL=postgres://...
lpm env list

lpm login
lpm env push

Local commands work without an account or network connection. Cloud features require an LPM.dev Registry account and the appropriate plan.

Choose the Right Scope

Capability	Availability
Local encrypted vault	Every LPM CLI installation
Named environments and schema validation	Every LPM CLI installation
Personal cloud sync	Pro account
Organization cloud sharing	Organization account
Dashboard access	Paired browser with access to a synced vault
Deployment-platform connections	Pro personal vault or Organization vault
OIDC pull in CI	Pro personal vault

Organization vaults use a separate per-member encryption model. OIDC CI escrow is not currently supported for organization vaults.

Local Vault

Store development, staging, and production values without leaving the machine:

lpm env set API_KEY=local-secret
lpm env set --env=staging API_KEY=staging-secret
lpm env get API_KEY
lpm env list --env=staging

Values are masked unless you explicitly reveal them. See Local Secrets for storage, import and export, schema validation, and project identity.

Cloud Sync

Personal Pro vaults can be encrypted locally and synchronized through LPM.dev Registry:

lpm env push
lpm env diff
lpm env pull

Ordinary cloud sync sends ciphertext and wrapped key material. The Registry can store and return the vault but cannot read its secret values. Push and pull operate on the complete project vault, including its named environments.

See Cloud Sync for overwrite behavior, version conflicts, metadata, and the encryption boundary.

Organization owners and admins can share a project vault with the organization:

lpm env share --org acme

Each authorized member receives a separately wrapped copy of the vault's encryption key. The Registry stores the shared ciphertext without receiving member private keys.

See Org Sharing for roles, member access, re-sharing, and offboarding.

Dashboard and Deployment Platforms

The LPM.dev Registry secrets dashboard can display and edit a synced vault after the browser is paired with an authorized LPM CLI installation. Decryption and re-encryption happen in the browser.

LPM CLI can also connect a vault to Vercel, Coolify, Fly.io, Railway, or GitHub Actions. Environment values travel directly between LPM CLI and the selected platform; LPM.dev Registry stores the encrypted platform credential and connection metadata.

The OIDC Exception

OIDC allows a verified CI workflow to pull a selected environment without a long-lived LPM.dev Registry token:

lpm env pull --oidc --env=production --output=.env

This is an explicit opt-in change to the trust model. Enabling CI escrow gives LPM.dev Registry protected key material that lets it decrypt the requested environment after the workflow and policy are verified. The plaintext is then returned to that CI job over TLS.

The Registry protects escrow material with a versioned server key. Server-key rotation does not change the env values or require a new policy.

See OIDC for CI before enabling it.

LPM CLI Reference

These pages describe the LPM.dev Registry product and its trust boundaries. For every command, flag, local format, and implementation detail, use: