Platform Integrations

LPM CLI can compare and synchronize a local project environment with Vercel, Coolify, Fly.io, Railway, or GitHub Actions.

Application keys and values travel directly between LPM CLI and the selected platform. LPM.dev Registry stores the connection, returns its credential to an authorized LPM CLI session, and records bounded operation metadata.

Supported Platforms

Platform	Target	Read Behavior
Vercel	Production, preview, or development variables	Values are readable and can be pulled.
Coolify	Production or preview application values	Readable values can be pulled.
Fly.io	Application secrets	Secrets are write-only; only names and digests can be checked.
Railway	Service or shared environment variables	Values are readable and can be pulled.
GitHub Actions	Repository or GitHub environment variables and secrets	Variables are readable; secrets are write-only.

Connect a Platform

Run the connection command from the local env project. For example:

lpm env connect vercel \
  --project=<vercel-project-id> \
  --linked-env=production \
  --target=production

LPM CLI prompts for the platform credential without echoing it, verifies the target directly with the platform, and then saves the connection through LPM.dev Registry.

Each provider needs different target identifiers and credential permissions. Use the LPM CLI platform reference for every connection flag and provider-specific setup requirement.

Availability

Env Project	Requirement
Personal	Pro account
Organization	Active Organization or Enterprise plan; caller must be an owner or admin

Connecting and synchronizing are LPM CLI operations. The dashboard can list connection metadata and disconnect a connection, but it does not create connections or run synchronization.

Push, Compare, and Pull

lpm env push --to vercel --env=production
lpm env status
lpm env pull --from vercel --env=production

Operation	Behavior
`push --to <platform>`	Adds missing values and updates changed values. Platform-only values remain.
`push --to <platform> --clean`	Also removes platform-only values from the configured target after confirmation.
`status`	Compares the linked local environment with the platform without changing either side.
`pull --from <platform>`	Imports readable platform values, overwrites matching local keys, and preserves local-only keys.

--linked-env selects a connection's default local environment. --env=<name> overrides it for one operation.

Cloud vault sync and platform deployment are separate:

lpm env push                    # encrypted personal vault → LPM.dev Registry
lpm env push --to railway       # local values → Railway

They are not one transaction. If one command fails, correct the cause and rerun that operation.

Readable and Write-Only Values

Vercel and Railway return readable values. Coolify returns readable application values when the credential has the necessary permissions.

Fly.io secrets are always write-only. GitHub Actions secrets are also write-only, while GitHub Actions variables are readable. For write-only values:

Status confirms that expected names exist; it does not prove value equality.
Pull skips the secret values.
Push refreshes the selected secret values.
--clean can remove extra secret names from the configured target.

Provider Notes

Vercel

A connection selects a Vercel project and optionally a team. It can target production, preview, development, or a combination of those deployment targets.

Coolify

The token must belong to a team administrator and allow read, write, and read:sensitive, or be a root token. A connection targets either production or preview application values.

Shared-variable references and shown-once values cannot be synchronized as readable application values.

Fly.io

A connection is bound to one Fly.io application and its organization. Fly.io does not return secret plaintext, so pull cannot recover application secret values.

Railway

A connection selects a project environment and either one service or the environment's shared variables. Railway account, workspace, and OAuth tokens use bearer authentication; project tokens use the dedicated project-token mode.

GitHub Actions

A connection targets repository-level Actions values or one GitHub environment.

LPM CLI uses lpm.json > envSchema to choose between Actions variables and secrets. Only a key declared with client: true and without secret: true becomes a readable variable. Undeclared, secret-marked, and ambiguous keys become write-only Actions secrets. Without a schema, every key becomes a secret.

Credential and Data Boundary

The platform credential is not end-to-end encrypted from LPM.dev Registry.

LPM CLI verifies the credential directly with the provider.
LPM CLI sends the credential and validated connection metadata to LPM.dev Registry.
LPM.dev Registry encrypts the credential at rest.
For an authorized operation, LPM.dev Registry decrypts the credential and returns it to LPM CLI in an authenticated response.
LPM CLI sends or reads application values directly through the platform API.

LPM.dev Registry does not receive application env keys or values during platform push, pull, or status. It stores connection scope and metadata plus bounded audit information such as the operation, environment name, and value counts.

Disconnect or Rotate a Credential

Disconnect from the env project's Integrations tab in the dashboard. Disconnecting removes the saved connection but does not delete values already stored by the platform.

To rotate a credential:

Revoke the old credential with the platform.
Run the corresponding lpm env connect <platform> ... command again.

The existing connection is updated with the new verified credential.