Klavex holds your team's environment variables in a single encrypted vault and injects them into your shell at runtime. Sync across the team in seconds — and scope what every Cursor, Claude Code, or Copilot session can actually see.
It might be in .gitignore, but it's still sitting plaintext on your disk — one read_file('.env') tool call away from a model's context window. And sharing it with the team is still a Slack DM.
The same .env that lets your dev server boot also feeds every coding agent in your editor — and getting a teammate set up is still a manual copy-paste ritual.
The team shares one encrypted vault. The CLI pulls the right secrets into the shell you're running — humans get everything, agents get only what you scope to them.
Install once. Authenticate once. Then every command you'd normally run gets klavex exec in front of it.
One Python package. Works on macOS, Linux, and WSL. The CLI is the only thing that ever talks to the vault.
Browser-based device login binds the CLI to your machine. No long-lived API keys to leak.
Wrap your dev server, test runner, deploy script — anything. Secrets are injected only into the child process.
Add Cursor, Claude Code, or any agent as a first-class team member with its own scoped token. Read-only by default, locked to specific environments, every fetch logged.
Built for engineers who ship every day. No proprietary file formats, no agent sprawl, no surprises in the audit log.
Envelope-encrypted with AES-256-GCM. A customer master key per team means crypto-shred deletes are real, not promised.
Production, Staging, Dev — and any custom env you need. Same keys, different values, scoped access per member.
Every reveal, every fetch, every membership change — by actor, IP, timestamp. 90-day retention on Team, longer on Enterprise.
Rotate a key in the dashboard. Every shell, every CI runner, every agent picks it up on next exec. No redeploys.
Owner / Admin / Editor / Viewer roles, plus per-environment access lists. Invite by email, revoke in a click.
klavex exec works in GitHub Actions, GitLab CI, and Docker. Or klavex export --format docker if you need a one-shot env file.
All plans include unlimited projects, environments, and variables — only the seat count and audit retention change.
For one developer with their own machine. Everything you need to never write a .env again.
For small teams sharing secrets across projects. The plan most Klavex customers run on.
For larger teams running Klavex across multiple squads or business units.
Install in 30 seconds. Migrate your first .env in 5 minutes. Sleep better tonight knowing the agents on your machine don't have a free copy of your AWS keys.