# Dotenvx Secrets

How this repo manages API secrets and the four local-run environments...

- Repository: https://github.com/kortix-ai/suna (20345 stars)
- Category: Git and review
- License: see repository
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add kortix-ai/suna --skill dotenvx-secrets -g -a claude-code -y`
Codex: `npx skills add kortix-ai/suna --skill dotenvx-secrets -g -a codex -y`
Cursor: `npx skills add kortix-ai/suna --skill dotenvx-secrets -g -a cursor -y`
Gemini CLI: `npx skills add kortix-ai/suna --skill dotenvx-secrets -g -a gemini-cli -y`

## Description

How this repo manages API secrets and the four local-run environments (local/dev/staging/prod). They are dotenvx-ENCRYPTED in git and the keys live in Dotenv Armor. Load this WHENEVER you touch a secret, API key, token, credential, or any apps/api/.env* file; whenever the user pastes a key/token/secret to store or use; whenever choosing/switching which environment to run; and whenever adding, reading, rotating, or sharing a secret.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Secrets & environments (this repo)

API secrets are **encrypted in git** with [dotenvx](https://dotenvx.com); the decryption keys live **off-device in Dotenv Armor**. This is mandatory, a plaintext secret never belongs in a tracked file.

## Armor organization and operational boundary

All API and web profiles belong to the single Armor organization **`kortix`**.
Always pass `--team kortix` when pushing or pulling. Never rely on the CLI's
personal-team default.

Access is scoped **per member, per armored key** (Dotenvx Armor FGAC, Business
plan; one armored key == one `.env*` file). Since 2026-08-26 the two PROD keys
(`apps/api/.env.prod`, `apps/web/.env.prod`) are granted to the **owner only**.
Every other member (admin or member role) has all `.env`, `.env.dev`, and
`.env.staging` keys. Armor refuses a non-owner `dotenvx run -f .env.prod`
(`PERMISSION_DENIED` on CLI 2.x); that is the intended boundary, not a broken login.

Manage access with `dotenvx curl` (CLI >= 2.18):

```sh
dotenvx curl "https://armor.dotenvx.com/api/teams/kortix/members"          # member ids + roles
dotenvx curl "https://armor.dotenvx.com/api/armor/keypairs?per=100"        # keys, named per file
dotenvx curl "https://armor.dotenvx.com/api/teams/kortix/members/<id>/keypairs/<public_key>/grant"  --request POST
dotenvx curl "https://armor.dotenvx.com/api/teams/kortix/members/<id>/keypairs/<public_key>/revoke" --request POST
dotenvx curl "https://armor.dotenvx.com/api/logs?team=kortix&events=keypair/access&keypair=<public_key>"  # who decrypted it
```

The rest: https://github.com/kortix-ai/suna/blob/HEAD/.agents/skills/dotenvx-secrets/SKILL.md