# turboEnv

> Versioned, encrypted environment variables with a CLI and an MCP server. Free, with no usage tiers.

turboEnv stores environment variables, encrypted at rest under a per-project key, and serves
them back over an authenticated HTTP API. Every save is an immutable version, so rollback and
diffing are exact. Projects belong to a team, and every member has the same access.

There are no per-language SDKs by design. Read the OpenAPI spec below and generate whatever
client the caller needs, or use the MCP server to fetch variables directly.

## Documentation

- [Quickstart](https://app.turboenv.workers.dev/docs/quickstart/): Store your first environment variables in turboEnv and load them into a running app, in about five minutes.
- [Concepts](https://app.turboenv.workers.dev/docs/concepts/): Projects, environments, versions and teams — the four ideas that turboEnv is built out of, in one page.
- [Project configuration](https://app.turboenv.workers.dev/docs/config/): Commit a turboenv.json so nobody has to remember flags, then safely pull and push dotenv files.
- [Tokens and access](https://app.turboenv.workers.dev/docs/tokens/): The two kinds of turboEnv credential, exactly what each one can reach, and which to use where.
- [Deploying and CI](https://app.turboenv.workers.dev/docs/deploying/): Loading turboEnv variables on a server, in Docker, and from a CI pipeline, using a scoped token instead of an interactive login.
- [CLI reference](https://app.turboenv.workers.dev/docs/cli/): Every turboenv command, option and environment variable, and the rules for how they combine.
- [HTTP API](https://app.turboenv.workers.dev/docs/api/): The turboEnv endpoints, what each returns, and how to generate a typed client in any language from the published OpenAPI spec.
- [AI agents](https://app.turboenv.workers.dev/docs/mcp/): Give an AI agent access to your turboEnv configuration over MCP, without putting secret values into its conversation history.

## API

- [OpenAPI specification (YAML)](https://app.turboenv.workers.dev/openapi.yaml): the complete public API. Bearer token auth, one token per environment or per project.
- [OpenAPI specification (JSON)](https://app.turboenv.workers.dev/openapi.json): the same document as JSON.
- [Health check](https://app.turboenv.workers.dev/api/v1/health): unauthenticated liveness endpoint.

## Tools

- [CLI](https://www.npmjs.com/package/turboenv-cli): `npx turboenv-cli run -- your-command` injects variables into a process at startup.
- [MCP server](https://www.npmjs.com/package/turboenv-mcp): lets an agent list environments, read variable names, and write a .env file. Secret values are withheld unless the operator opts in.

## Writing

- [Envelope encryption, and what "encrypted at rest" actually promises](https://app.turboenv.workers.dev/blog/envelope-encryption-explained/): A practical explanation of wrapping a data key under a master key, why it makes rotation cheap, and the specific attacks it does and does not stop.
- [Managing environment variables across development, staging and production](https://app.turboenv.workers.dev/blog/environment-variables-across-environments/): Why the .env-per-developer approach breaks down, what drift actually costs, and the properties worth insisting on when you replace it.
- [How to remove a .env file from Git history](https://app.turboenv.workers.dev/blog/remove-env-file-from-git-history/): Deleting the file and committing is not enough. Here is how to rewrite the history properly, and why rotating the secrets matters more than the rewrite.

## Policies

- [Privacy](https://app.turboenv.workers.dev/privacy): what is stored, and the limits of encryption held by the operator.
- [Terms](https://app.turboenv.workers.dev/terms): no warranty, no uptime guarantee, and no security certifications claimed.