Dotenvx Secrets
How this repo manages API secrets and the four local-run environments...
Install
npx skills add kortix-ai/suna --skill dotenvx-secrets -g -a claude-code -y- Repository
- kortix-ai/suna20.3k
- Category
- Git and review
- Updated
- 3d ago
- License
- See repository
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
How this repo manages API secrets and the four local-run environments (local/dev/staging/prod). They are dotenvx-ENCRYPTED in git and the keys live in Dotenv Armor. Load this WHENEVER you touch a secret, API key, token, credential, or any apps/api/.env* file; whenever the user pastes a key/token/secret to store or use; whenever choosing/switching which environment to run; and whenever adding, reading, rotating, or sharing a secret.
Secrets & environments (this repo)
API secrets are encrypted in git with dotenvx; the decryption keys live off-device in Dotenv Armor. This is mandatory, a plaintext secret never belongs in a tracked file.
Armor organization and operational boundary
All API and web profiles belong to the single Armor organization kortix.
Always pass --team kortix when pushing or pulling. Never rely on the CLI's
personal-team default.
Access is scoped per member, per armored key (Dotenvx Armor FGAC, Business
plan; one armored key == one .env* file). Since 2026-08-26 the two PROD keys
(apps/api/.env.prod, apps/web/.env.prod) are granted to the owner only.
Every other member (admin or member role) has all .env, .env.dev, and
.env.staging keys. Armor refuses a non-owner dotenvx run -f .env.prod
(PERMISSION_DENIED on CLI 2.x); that is the intended boundary, not a broken login.
Manage access with dotenvx curl (CLI >= 2.18):
dotenvx curl "https://armor.dotenvx.com/api/teams/kortix/members" # member ids + roles
dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs?per=100" # keys, named per file
dotenvx curl "https://armor.dotenvx.com/api/teams/kortix/members/<id>/keypairs/<public_key>/grant" --request POST
dotenvx curl "https://armor.dotenvx.com/api/teams/kortix/members/<id>/keypairs/<public_key>/revoke" --request POST
dotenvx curl "https://armor.dotenvx.com/api/logs?team=kortix&events=keypair/access&keypair=<public_key>" # who decrypted it
