Local Secrets

The LPM CLI local vault stores project environment variables without requiring an LPM.dev Registry account or network connection.

lpm env set DATABASE_URL=postgres://localhost/app
lpm env get DATABASE_URL
lpm env list

Store and Read Values

set accepts one or more KEY=VALUE pairs:

lpm env set API_KEY=sk-local
lpm env set "GREETING=hello world" PORT=3000
lpm env set --env=staging API_KEY=sk-staging

Setting an existing key replaces its value.

Reads are masked by default:

lpm env get API_KEY
lpm env list

Use --reveal only when plaintext output is intentional:

lpm env get API_KEY --reveal
lpm env list --reveal

get --reveal prints the raw value. list --reveal prints every key and value in the selected environment.

Delete one or more values with:

lpm env delete API_KEY
lpm env delete API_KEY DATABASE_URL

Import and Export Dotenv Files

lpm env import .env
lpm env import .env.production --env=production
lpm env import .env --overwrite

An import skips keys that already exist unless --overwrite is supplied. LPM CLI adds the imported file to the project .gitignore.

Export writes plaintext:

lpm env export .env.backup
lpm env export .env.staging --env=staging

LPM CLI writes exports atomically, uses owner-only 0600 permissions on Unix, and adds the output path to .gitignore. Treat the resulting file as a secret even though it is ignored by Git.

Dotenv parsing supports assignments, comments, quoted values, and export KEY=VALUE. It does not expand $OTHER_VARIABLE references.

Print a Resolved Environment

lpm env print combines dotenv files, vault values, environment inheritance, and schema defaults. Its default format is dotenv:

lpm env print
lpm env print --env=staging
lpm env print --format=json

To export values into the current shell, request shell syntax explicitly:

eval "$(lpm env print --format=shell)"

Printing or evaluating an environment reveals its values. Prefer lpm run or lpm dev, which inject the resolved environment directly into the child process.

Validate an Environment Schema

Define the schema under lpm.json > envSchema > vars:

{
  "envSchema": {
    "vars": {
      "DATABASE_URL": {
        "required": true,
        "format": "url",
        "secret": true
      },
      "PORT": {
        "required": false,
        "format": "port",
        "default": "3000"
      }
    }
  }
}

lpm env check
lpm env example

lpm env check validates every discovered environment against the schema. It reports missing required values, invalid formats, pattern failures, and other rule violations. It does not accept an environment selector.

lpm env example generates .env.example. Supplying --env=<name> changes the generated filename to .env.<name>.example.

LPM CLI also validates the resolved environment before lpm run, lpm dev, file execution, and lpm exec. Those execution commands provide --no-env-check when validation must be bypassed deliberately.

See the LPM CLI lpm.json reference for every schema rule.

Initialize Existing Projects

lpm env init
lpm env ls

lpm env init scans the environment configuration and conventional .env files. It imports files into missing vault environments and leaves environments that already contain secrets unchanged. --force allows those existing values to be replaced.

lpm env ls shows known environment names, stored-value counts, schema coverage, aliases, and the project-level cloud-sync status.

Where Local Data Lives

Platform	Local storage
macOS	Project vault data in Keychain under `dev.lpm.vault`
Linux	Encrypted file at `~/.lpm/vaults/<vault-id>.enc`; data key protected by Secret Service when available
Windows	Encrypted file at `~/.lpm/vaults/<vault-id>.enc`; data key protected by Credential Manager

When LPM CLI creates a project vault, it records a stable identifier in lpm.json:

{
  "vault": "7f3a1e2c-5b9d-4a8f-b6c1-9b1d2e3f4a5b"
}

The identifier is an opaque pointer, not a secret. Commit lpm.json so the project keeps the same vault identity after it is moved or cloned. Removing the field creates a new identity on the next operation that needs a vault; it does not delete the previous local or cloud data.