dotsecenv

https://dotsecenv.com
Admin
dotsecenv is a secret management tool that encrypts environment variables at rest using GPG and...
Tokens:45,714
Snippets:680
Trust Score:4.4
Update:5 months ago
Show doc for...
Tokens:
Raw
### Complete Workflow Example with dotsecenv

Source: https://dotsecenv.com/guides/github-action

A full GitHub Actions workflow demonstrating the installation and basic usage of the dotsecenv action.

```yaml
name: Build

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: dotsecenv/dotsecenv@v0
        with:
          init-config: ''

      - name: Build with secrets
        run: |
          dotsecenv version
          # dotsecenv secret get YOUR_SECRET | ...
```

--------------------------------

### Install dotsecenv with Install Script

Source: https://dotsecenv.com/tutorials/installation

Use the universal installer script for the fastest installation. It auto-detects your platform and handles binary download, checksum verification, and shell completions. Customize installation directory and shell plugin behavior with flags or environment variables.

```bash
curl -fsSL https://get.dotsecenv.com/install.sh | bash
```

```bash
curl -fsSL https://get.dotsecenv.com/install.sh | bash -s -- --version v1.2.3
```

```bash
curl -fsSL https://get.dotsecenv.com/install.sh | bash -s \
  --install-dir ~/.local/bin \
  --no-install-shell-plugin
```

```bash
VERSION=v1.2.3 INSTALL_DIR=/opt/bin \
  curl -fsSL https://get.dotsecenv.com/install.sh | bash
```

--------------------------------

### Use dotsecenv in Workflow Steps

Source: https://dotsecenv.com/guides/github-action

After installation, dotsecenv commands are available in subsequent steps. This example shows how to run `dotsecenv version`.

```yaml
        - name: Use secrets
          run: |
            dotsecenv version
            # Your commands that use dotsecenv
```

--------------------------------

### Install DotSecEnv with CLI Flags

Source: https://dotsecenv.com/tutorials/installation

Install DotSecEnv using the install script with command-line options for customization.

```bash
# Piped with CLI flags
curl -fsSL https://get.dotsecenv.com/install.sh | bash -s -- [OPTIONS]
```

--------------------------------

### Install Dotsecenv via Script

Source: https://dotsecenv.com/getting-started

Install dotsecenv using the provided installation script. This method downloads the binary, verifies signatures, and sets up shell plugins and man pages.

```bash
curl -fsSL https://get.dotsecenv.com/install.sh | bash
```

--------------------------------

### Download and Run Install Script Locally

Source: https://dotsecenv.com/tutorials/installation

Download the install script first, then execute it locally. This allows for inspection before running.

```bash
# Downloaded and run locally
curl -fsSL https://get.dotsecenv.com/install.sh -o install.sh
chmod +x install.sh
./install.sh --version v1.2.3
```

--------------------------------

### Install dotsecenv from source

Source: https://dotsecenv.com/

Builds and installs dotsecenv from its source code repository.

```bash
git clone https://github.com/dotsecenv/dotsecenv.git
cd dotsecenv && make build
```

--------------------------------

### Download, Inspect, and Run Install Script

Source: https://dotsecenv.com/tutorials/installation

Download the DotSecEnv install script, review its contents, and then execute it with a specific version.

```bash
curl -fsSL https://get.dotsecenv.com/install.sh -o install.sh
less install.sh  # review the script
bash install.sh --version v1.2.3
```

--------------------------------

### GitHub Actions CI/CD Integration

Source: https://dotsecenv.com/concepts/architecture

Provides an example of setting up GPG, installing Dotsecenv, and retrieving secrets within a GitHub Actions workflow.

```yaml
# GitHub Actions example
- name: Setup GPG
  run: echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --import

# Install dotsecenv in your GitHub workflow
- uses: dotsecenv/dotsecenv@v0

- name: Get secrets
  run: |
    export API_KEY=$(dotsecenv secret get API_KEY)
    ./deploy.sh
```

--------------------------------

### Install DotSecEnv via Piped Script

Source: https://dotsecenv.com/tutorials/installation

The simplest way to install DotSecEnv by piping the install script directly to bash.

```bash
# Piped (simplest)
curl -fsSL https://get.dotsecenv.com/install.sh | bash
```

--------------------------------

### Check DotSecEnv Version and Help

Source: https://dotsecenv.com/tutorials/installation

Verify the installation by checking the version and accessing the help menu.

```bash
# Check version
dotsecenv version
```

```bash
# See available commands
dotsecenv --help
```

```bash
# Tab-complete commands (after shell restart)
dotsecenv <TAB>
```

--------------------------------

### Using dotsecenv with direnv for environment variables

Source: https://dotsecenv.com/concepts/comparison

This example shows how to integrate dotsecenv with direnv to manage encrypted secrets alongside regular environment setup. Ensure dotsecenv is installed and configured for shell completion.

```bash
# .envrc (direnv) - Non-sensitive setup
export PATH="$PWD/bin:$PATH"
layout python
eval "$(dotsecenv completion bash)"

# .secenv (dotsecenv) - Encrypted secrets
DATABASE_PASSWORD={dotsecenv}
API_KEY={dotsecenv}
```

--------------------------------

### Recommended setup with direnv and dotsecenv

Source: https://dotsecenv.com/guides/shell-plugins

This setup uses direnv for non-sensitive configuration in .env files and dotsecenv for secrets from your vault in .secenv files.

```shell
# .env: handled by direnv
DATABASE_HOST=localhost
DATABASE_PORT=5432
LOG_LEVEL=debug

# .secenv: handled by dotsecenv
DATABASE_PASSWORD={dotsecenv}
API_KEY={dotsecenv/production::API_KEY}
```

--------------------------------

### Install dotsecenv with mise

Source: https://dotsecenv.com/

Installs dotsecenv using the mise version manager.

```bash
mise use github:dotsecenv/dotsecenv
```

--------------------------------

### Dotsecenv Configuration File Example

Source: https://dotsecenv.com/reference

This is a comprehensive example of the dotsecenv configuration file, showing settings for approved algorithms, vault paths, user login identity, behavior flags, and GPG program location.

```yaml
# Approved algorithms (minimum strength)
approved_algorithms:
  - algo: ECC
    curves: [P-384, P-521]
    min_bits: 384
  - algo: EdDSA
    curves: [Ed25519, Ed448]
    min_bits: 255
  - algo: RSA
    min_bits: 2048

# Vault file path(s)
vault:
  - ~/.config/dotsecenv/vault

# Active user identity (signed login block, populated by `dotsecenv login <FP>`)
login:
  fingerprint: E60A1740BAEF49284D22EA7D3C376348F0921C59
  added_at: "2026-04-25T12:00:00Z"
  hash: "<sha-256 of 'login:<added_at>:<fingerprint>'>"
  signature: "<hex-encoded detached GPG signature of hash>"

# Behavior settings (all default to false)
behavior:
  require_explicit_vault_upgrade: false
  restrict_to_configured_vaults: false

# GPG executable path
gpg:
  program: /usr/bin/gpg

```

--------------------------------

### Minimal DotSecEnv Install (Binary Only)

Source: https://dotsecenv.com/tutorials/installation

Perform a minimal installation of DotSecEnv, including only the binary and disabling shell plugins, completions, and man pages.

```bash
curl -fsSL https://get.dotsecenv.com/install.sh | bash -s -- \
  --no-install-shell-plugin \
  --no-install-completions \
  --no-install-man-pages
```

--------------------------------

### Install DotSecEnv with Environment Variables

Source: https://dotsecenv.com/tutorials/installation

Configure the installation of DotSecEnv using environment variables, suitable for automated pipelines.

```bash
# Piped with environment variables
VERSION=v1.2.3 curl -fsSL https://get.dotsecenv.com/install.sh | bash
```

--------------------------------

### Install Dotsecenv on macOS with Homebrew

Source: https://dotsecenv.com/getting-started

Install dotsecenv on macOS using Homebrew by tapping the official repository and then installing the package.

```bash
brew tap dotsecenv/tap
brew install dotsecenv
```

--------------------------------

### Configuration Override Examples

Source: https://dotsecenv.com/concepts/architecture

Shows how to specify a custom configuration file path using either a command-line flag or an environment variable.

```bash
# CLI flag
dotsecenv -c /path/to/config secret get KEY

# Environment variable
DOTSECENV_CONFIG=/path/to/config dotsecenv secret get KEY
```

--------------------------------

### Custom Install Directory with Terraform Helper

Source: https://dotsecenv.com/tutorials/installation

Install DotSecEnv to a custom directory and include the Terraform credentials helper.

```bash
curl -fsSL https://get.dotsecenv.com/install.sh | bash -s -- \
  --install-dir /opt/dotsecenv/bin \
  --install-tf-credentials-helper
```

--------------------------------

### Install Dotsecenv on Linux with apt

Source: https://dotsecenv.com/getting-started

Install dotsecenv on Debian-based Linux systems using apt. This involves adding the GPG key and repository, then updating and installing the package.

```bash
curl -fsSL https://get.dotsecenv.com/key.asc | \
  sudo gpg --dearmor -o /etc/apt/keyrings/dotsecenv.gpg
echo "deb [signed-by=/etc/apt/keyrings/dotsecenv.gpg] \
    https://get.dotsecenv.com/apt/ ./" | \
  sudo tee /etc/apt/sources.list.d/dotsecenv.list
sudo apt-get update && sudo apt-get install dotsecenv
```

--------------------------------

### Install DotSecEnv Plugin for Fish (Manual)

Source: https://dotsecenv.com/guides/shell-plugins

Manually source the Fish plugin configuration file.

```bash
source /path/to/conf.d/dotsecenv.fish
```

--------------------------------

### Install Dotsecenv Shell Plugins

Source: https://dotsecenv.com/how-to

Install shell plugins for dotsecenv to enable features like auto-loading secrets. This script downloads and executes the installer.

```bash
curl -fsSL https://raw.githubusercontent.com/dotsecenv/plugin/main/install.sh | bash
```

--------------------------------

### Install dotsecenv on Fedora/RHEL

Source: https://dotsecenv.com/

Installs dotsecenv on Fedora/RHEL systems by configuring the DNF repository.

```bash
cat <<EOF | sudo tee /etc/yum.repos.d/dotsecenv.repo
[dotsecenv]
name=DotSecEnv Repository
baseurl=https://get.dotsecenv.com/yum/
enabled=1
gpgcheck=1
repo_gpgcheck=1
gpgkey=https://get.dotsecenv.com/key.asc
EOF

sudo dnf install dotsecenv
```

--------------------------------

### Install Bash Shell Completions

Source: https://dotsecenv.com/tutorials/installation

Install Bash shell completions either system-wide by piping to a completion directory or user-level by evaluating the output in your .bashrc.

```bash
# System-wide
dotsecenv completion bash | sudo tee /etc/bash_completion.d/dotsecenv

# Or user-level (add to ~/.bashrc)
eval "$(dotsecenv completion bash)"
```

--------------------------------

### Example .env file

Source: https://dotsecenv.com/tutorials/migrate-from-dotenv

A typical .env file containing both sensitive and non-sensitive configuration values.

```bash
# .env
DATABASE_HOST=localhost
DATABASE_PORT=5432
DATABASE_NAME=myapp
DATABASE_PASSWORD=super-secret-password
API_KEY=sk-live-abc123xyz
```

--------------------------------

### Install dotsecenv on Ubuntu/Debian

Source: https://dotsecenv.com/

Installs dotsecenv on Ubuntu/Debian systems by adding the official repository and GPG key.

```bash
curl -fsSL https://get.dotsecenv.com/key.asc | \
  sudo gpg --dearmor -o /etc/apt/keyrings/dotsecenv.gpg

echo "deb [signed-by=/etc/apt/keyrings/dotsecenv.gpg] \
  https://get.dotsecenv.com/apt/ ./
" | \
  sudo tee /etc/apt/sources.list.d/dotsecenv.list

sudo apt-get update && sudo apt-get install dotsecenv
```

--------------------------------

### Install DotSecEnv Plugin for Zsh (Manual)

Source: https://dotsecenv.com/guides/shell-plugins

Manually source the Zsh plugin file.

```bash
source /path/to/dotsecenv.plugin.zsh
```

--------------------------------

### Install dotsecenv Action

Source: https://dotsecenv.com/guides/github-action

Add this step to your workflow to install the dotsecenv GitHub Action. It downloads, verifies, and adds dotsecenv to your PATH.

```yaml
        - uses: dotsecenv/dotsecenv@v0
```

--------------------------------

### Install dotsecenv on Arch Linux

Source: https://dotsecenv.com/

Installs dotsecenv on Arch Linux by adding the official repository to pacman.conf and importing the GPG key.

```bash
cat <<'EOF' | sudo tee -a /etc/pacman.conf
[dotsecenv]
Server = https://get.dotsecenv.com/arch/$arch
SigLevel = Required DatabaseOptional
EOF


curl -fsSL https://get.dotsecenv.com/key.asc | sudo pacman-key --add -
sudo pacman-key --lsign-key E60A1740BAEF49284D22EA7D3C376348F0921C59
sudo pacman -Sy dotsecenv
```

--------------------------------

### Verify Dotsecenv Installation

Source: https://dotsecenv.com/getting-started

Check if dotsecenv is installed correctly by running the version command.

```bash
dotsecenv version
```

--------------------------------

### Install dotsecenv helper (Manual)

Source: https://dotsecenv.com/guides/terraform-credentials-helper

Manually download and install the dotsecenv credentials helper script to a Terraform plugin directory, ensuring it is executable. This method is suitable for Linux and systems following the XDG Base Directory specification.

```bash
# Linux / XDG Base Directory fallback
PLUGIN_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/terraform/plugins"
mkdir -p "$PLUGIN_DIR"
curl -fsSL https://raw.githubusercontent.com/dotsecenv/dotsecenv/main/contrib/terraform-credentials-dotsecenv \
  -o "$PLUGIN_DIR/terraform-credentials-dotsecenv"
chmod +x "$PLUGIN_DIR/terraform-credentials-dotsecenv"
```

--------------------------------

### User Configuration Example

Source: https://dotsecenv.com/concepts/policy-directory

This YAML shows a user's personal dotsecenv configuration, including approved algorithms and vault paths.

```yaml
# ~/.config/dotsecenv/config.yaml
approved_algorithms:
  - algo: RSA
    min_bits: 2048
  - algo: ECC
    curves: [P-256, P-384]
    min_bits: 256
vault:
  - ~/personal-secrets/vault
  - /srv/secrets/team-a/vault

```

--------------------------------

### Install DotSecEnv Plugin for Fish (Fisher)

Source: https://dotsecenv.com/guides/shell-plugins

Use Fisher to install the DotSecEnv plugin for Fish shell.

```bash
fisher install dotsecenv/plugin
```

--------------------------------

### List Mode Output Example

Source: https://dotsecenv.com/reference

Example of the output format when listing secrets without the --json flag.

```text
DATABASE_PASSWORD
prod::API_KEY
OLD_SECRET (deleted)
```

--------------------------------

### Show version information (Example Output)

Source: https://dotsecenv.com/reference

Displays version information for dotsecenv. This includes the version number, commit hash, build timestamp, Go build version, and FIPS 140 compliance details.

```text
$ dotsecenv version

```

--------------------------------

### Install DotSecEnv Plugin for Zsh (Oh-My-Zsh)

Source: https://dotsecenv.com/guides/shell-plugins

Clone the plugin repository and add `dotsecenv` to your plugins list in `~/.zshrc`.

```bash
git clone https://github.com/dotsecenv/plugin.git \
  ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/dotsecenv
```

```bash
plugins=(... dotsecenv)
```

--------------------------------

### Uninstall dotsecenv Binary Installation

Source: https://dotsecenv.com/tutorials/installation

Remove the dotsecenv binary if it was installed manually to /usr/local/bin.

```bash
sudo rm /usr/local/bin/dotsecenv
```

--------------------------------

### List Mode JSON Output Example

Source: https://dotsecenv.com/reference

Example of the output format when listing secrets with the --json flag.

```json
[
  {
    "key": "DATABASE_PASSWORD",
    "vault": "~/.local/share/dotsecenv/vault"
  },
  {
    "key": "prod::API_KEY",
    "vault": "~/.local/share/dotsecenv/vault"
  },
  {
    "key": "OLD_SECRET",
    "vault": "~/.local/share/dotsecenv/vault",
    "deleted": true
  }
]
```

--------------------------------

### Basic GitHub Actions Workflow Setup

Source: https://dotsecenv.com/guides/github-action

This YAML snippet sets up a basic GitHub Actions workflow with checkout. It serves as the foundation for adding the dotsecenv action.

```yaml
name: Build

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
```

--------------------------------

### Install and Use dotsecenv in GitLab CI

Source: https://dotsecenv.com/how-to

This configuration installs dotsecenv and uses it to retrieve secrets within a GitLab CI pipeline. Ensure GPG is installed and the private key is available as a CI/CD variable.

```yaml
deploy:
  script:
    - apt-get update && apt-get install -y gpg
    - curl -LO https://get.dotsecenv.com/linux/dotsecenv_latest_Linux_x86_64.tar.gz
    - tar -xzf dotsecenv_*.tar.gz && mv dotsecenv /usr/local/bin/
    - echo "$GPG_PRIVATE_KEY" | gpg --import
    - export API_KEY=$(dotsecenv secret get API_KEY)
    - ./deploy.sh
```

--------------------------------

### Install dotsecenv helper (macOS)

Source: https://dotsecenv.com/guides/terraform-credentials-helper

Symlink the dotsecenv credentials helper into a Terraform plugin directory on macOS after installing dotsecenv via Homebrew.

```bash
mkdir -p ~/.terraform.d/plugins
ln -s "$(brew --prefix dotsecenv)/contrib/terraform-credentials-dotsecenv" \
  ~/.terraform.d/plugins/terraform-credentials-dotsecenv
```

--------------------------------

### Using .env and .secenv together

Source: https://dotsecenv.com/tutorials/first-secret

Example of combining a non-sensitive .env file with a sensitive .secenv file for configuration.

```bash
# .env - Non-sensitive configuration
DATABASE_HOST=localhost
DATABASE_PORT=5432
DATABASE_NAME=myapp

# .secenv - Sensitive secrets
DATABASE_PASSWORD={dotsecenv}
```

--------------------------------

### Install DotSecEnv Plugin for Bash (Manual)

Source: https://dotsecenv.com/guides/shell-plugins

Manually source the Bash plugin file in your `~/.bashrc`.

```bash
source /path/to/dotsecenv.plugin.bash
```

--------------------------------

### Install DotSecEnv Plugin for Zsh (Antigen)

Source: https://dotsecenv.com/guides/shell-plugins

Use Antigen to bundle the DotSecEnv plugin.

```bash
antigen bundle dotsecenv/plugin
```

--------------------------------

### Install dotsecenv in GitHub Actions

Source: https://dotsecenv.com/how-to

This step installs the dotsecenv CLI in a GitHub Actions workflow. Ensure you have the GPG key imported for secret decryption.

```yaml
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Install dotsecenv
        run: |
          curl -LO https://get.dotsecenv.com/linux/dotsecenv_latest_Linux_x86_64.tar.gz
          tar -xzf dotsecenv_*.tar.gz
          sudo mv dotsecenv /usr/local/bin/

      - name: Import GPG key
        run: echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --import

      - name: Deploy
        run: |
          export DATABASE_PASSWORD=$(dotsecenv secret get DATABASE_PASSWORD)
          ./deploy.sh
```

--------------------------------

### Development Environment Configuration

Source: https://dotsecenv.com/concepts/behavior-settings

Example configuration for a development environment, using default permissive behavior settings.

```yaml
approved_algorithms:
  - algo: RSA
    min_bits: 2048
vault:
  - ~/.local/share/dotsecenv/vault
gpg:
  program: PATH
# behavior section omitted - all defaults (permissive)
```

--------------------------------

### PowerShell Completion Setup

Source: https://dotsecenv.com/tutorials/installation

Set up PowerShell completion by adding the command to your PowerShell profile. Note that Windows support is under development.

```powershell
# Add to your PowerShell profile ($PROFILE)
dotsecenv completion powershell | Out-String | Invoke-Expression
```

--------------------------------

### Verify dotsecenv helper installation (Linux)

Source: https://dotsecenv.com/guides/terraform-credentials-helper

Check if the terraform-credentials-dotsecenv helper is installed in the default plugin directory on Linux systems using apt or rpm.

```bash
ls /usr/share/terraform/plugins/terraform-credentials-dotsecenv
```

--------------------------------

### Install dotsecenv Plugin in Claude Code

Source: https://dotsecenv.com/guides/claude-code

Install the dotsecenv plugin after adding its marketplace. This registers skills for managing secrets and interpreting .secenv files.

```text
/plugin install dotsecenv@dotsecenv
```

--------------------------------

### CI/CD Install with Specific Version and Skipped Components

Source: https://dotsecenv.com/tutorials/installation

Install a specific version of DotSecEnv in a CI/CD environment, disabling interactive components like shell plugins and man pages.

```bash
VERSION=v1.2.3 INSTALL_SHELL_PLUGIN=0 INSTALL_MAN_PAGES=0 \
  curl -fsSL https://get.dotsecenv.com/install.sh | bash
```

--------------------------------

### Example: List Secrets with Claude Code

Source: https://dotsecenv.com/guides/claude-code

An example interaction showing how to ask Claude Code to list your secrets using the dotsecenv plugin. Claude will execute the appropriate dotsecenv command.

```text
You: list my secrets

Claude: Running dotsecenv secret get...

  myapp::API_KEY
  myapp::DB_PASSWORD
  staging::JWT_SECRET

You have 3 secrets across 1 vault.
```

--------------------------------

### Example Stored Secret JSON

Source: https://dotsecenv.com/guides/terraform-credentials-helper

This is an example of the JSON output when retrieving a stored secret using `dotsecenv secret get --json`. It shows the added timestamp, the secret value, and the vault location.

```json
{
  "added_at": "2026-01-15T10:30:00Z",
  "value": { "token": "my-api-token" },
  "vault": "~/.secenv.vault"
}
```

--------------------------------

### Example Policy Fragment Structure

Source: https://dotsecenv.com/concepts/policy-directory

A sample YAML fragment demonstrating the structure for defining approved algorithms, vault paths, behavior scalars, and GPG program settings.

```yaml
approved_algorithms:    # allow-list
approved_vault_paths:   # allow-list
behavior:               # scalars
  require_explicit_vault_upgrade:
  restrict_to_configured_vaults:
gpg:                    # scalar
  program:
```

--------------------------------

### GitLab CI Configuration for dotsecenv

Source: https://dotsecenv.com/tutorials/ci-cd-secrets

Example GitLab CI configuration to set up dotsecenv. It includes importing the GPG key and logging in, similar to the GitHub Actions workflow.

```yaml
build:
  image: ubuntu:latest
  before_script:
    - curl -fsSL https://get.dotsecenv.com/install.sh | bash -s -- --no-install-shell-plugin
    - echo "$GPG_PRIVATE_KEY" | base64 -d | gpg --batch --import
    - dotsecenv init config
    - dotsecenv login $(gpg --list-secret-keys --keyid-format long | grep -A1 "sec" | tail -1 | awk '{print $1}')
  script:
    - DATABASE_PASSWORD=$(dotsecenv secret get DATABASE_PASSWORD)
    - echo "Secret available in pipeline"
```

--------------------------------

### Integrate dotsecenv with Git and Shell

Source: https://dotsecenv.com/concepts/philosophy

Demonstrates how to add the dotsecenv vault to Git and install shell integration for seamless use with other development tools.

```bash
# With git
git add vault && git commit -m "Add API keys"
```

```bash
# With shell integration
curl -fsSL https://raw.githubusercontent.com/dotsecenv/plugin/main/install.sh | bash
```

--------------------------------

### Install Fish shell plugin

Source: https://dotsecenv.com/tutorials/first-secret

Add the dotsecenv shell plugin and auto-load hook to your ~/.config/fish/config.fish file. Reload your shell after adding.

```fish
# dotsecenv completions
dotsecenv completion fish | source

# Auto-load .secenv files
function _dotsecenv_hook --on-variable PWD
  if test -f .secenv
    dotsecenv env load | source
  end
end
```

--------------------------------

### Configure GPG path for Windows installation

Source: https://dotsecenv.com/tutorials/installation

For Windows installations, manually configure the GPG program path in your dotsecenv config file if it's not automatically detected.

```yaml
gpg:
  program: "C:\\Program Files (x86)\\GnuPG\\bin\\gpg.exe"
```

--------------------------------

### Initialize dotsecenv and Log In

Source: https://dotsecenv.com/tutorials/team-onboarding

Initialize dotsecenv configuration and log in. You will be prompted to select your GPG key.

```bash
dotsecenv init config
dotsecenv login
```

--------------------------------

### Vault File Format Example

Source: https://dotsecenv.com/concepts/architecture

Illustrates the structure of the vault's JSONL file, including header and data entries.

```text
# === VAULT HEADER v1 ===
Line 2: Header JSON with metadata and indexes
# === VAULT DATA ===
Line 4+: Identity entries, secret definitions, and secret values
```

```json
{"version":1,"identities":[["ABC123",4],["DEF456",5]],"secrets":{"DATABASE_URL":{"secret":6,"values":[7]}}}
{"type":"identity","data":{"fingerprint":"ABC123","uid":"alice@example.com","algorithm":"RSA","algorithm_bits":4096}}
{"type":"identity","data":{"fingerprint":"DEF456","uid":"bob@example.com","algorithm":"EdDSA","curve":"Ed25519"}}
{"type":"secret","data":{"key":"DATABASE_URL","signed_by":"ABC123","added_at":"2025-01-01T00:00:00Z"}}
{"type":"value","secret":"DATABASE_URL","data":{"available_to":["ABC123","DEF456"],"value":"encrypted..."}}
```

--------------------------------

### Example of Dotsecenv Shell Plugin Interaction

Source: https://dotsecenv.com/guides/shell-plugins

Demonstrates the typical interaction with the dotsecenv shell plugin, including loading secrets upon entering a directory and unloading them upon leaving.

```text
~/project $ cd myapp/
dotsecenv: found .secenv in /home/user/myapp
Load secrets? [y]es / [n]o / [a]lways: y
dotsecenv: loaded 2 secret(s) from .secenv: DATABASE_URL, API_KEY

~/project/myapp $ cd src/         # Secrets persist in subdirectories
~/project/myapp/src $ cd ../..    # Leave the tree
dotsecenv: unloaded 2 secret(s): DATABASE_URL, API_KEY
```

--------------------------------

### Policy Directory Configuration Example

Source: https://dotsecenv.com/concepts/policy-directory

This YAML demonstrates an administrator-defined policy fragment for the policy directory, enforcing stricter algorithm requirements and restricting vault paths.

```yaml
# /etc/dotsecenv/policy.d/50-org-baseline.yaml
approved_algorithms:
  - algo: ECC
    curves: [P-384, P-521]
    min_bits: 384
approved_vault_paths:
  - /srv/secrets/*/vault
behavior:
  restrict_to_configured_vaults: true

```

--------------------------------

### Initialize Configuration

Source: https://dotsecenv.com/reference

Use to create a new configuration file. By default, it uses FIPS-compliant algorithm minimums and resolves the gpg binary from the system PATH.

```bash
# Create default config (FIPS-compliant by default).
# gpg.program is set to "PATH" (resolved from system PATH at runtime).
dotsecenv init config

# Create config at custom location
dotsecenv init config -c ~/my-project/dotsecenv.yaml

# Pin GPG to an absolute path (skips runtime PATH lookup)
dotsecenv init config --gpg-program /usr/local/bin/gpg

# Initialize with login fingerprint
dotsecenv init config --login E60A1740BAEF49284D22EA7D3C376348F0921C59
```

--------------------------------

### Namespaced Secret Example

Source: https://dotsecenv.com/concepts/architecture

Demonstrates the use of namespaces for organizing secrets across different environments or services.

```text
prod::DATABASE_URL      → Production database URL
staging::DATABASE_URL   → Staging database URL
api::JWT_SECRET         → API service JWT secret
```

--------------------------------

### Load secrets from .secenv file

Source: https://dotsecenv.com/guides/shell-plugins

Examples of loading secrets from a .secenv file, including direct loading, loading with a specific name, and loading from a namespace.

```shell
DATABASE_PASSWORD={dotsecenv}
```

```shell
DB_PASS={dotsecenv/DATABASE_PASSWORD}
```

```shell
NODE_ENV=production
```

```shell
API_KEY={dotsecenv/production::API_KEY}
```

--------------------------------

### Vault Configuration Example

Source: https://dotsecenv.com/concepts/architecture

Defines paths to vault files, active user identity, and approved cryptographic algorithms. Ensure vault files have restrictive permissions.

```yaml
# Vault file path(s)
vault:
  - ~/.config/dotsecenv/vault
  - ~/work/project/secrets/vault

# Active user identity (signed login block, populated by `dotsecenv login <FP>`)
login:
  fingerprint: E60A1740BAEF49284D22EA7D3C376348F0921C59
  added_at: "2026-04-25T12:00:00Z"
  hash: "<sha-256 of 'login:<added_at>:<fingerprint>'>"
  signature: "<hex-encoded detached GPG signature of hash>"

# Approved algorithms (minimum strength)
approved_algorithms:
  - rsa:3072
  - ecdsa:p384
  - eddsa:ed25519
```

--------------------------------

### Set Up Bash Shell Completions

Source: https://dotsecenv.com/how-to

Enable tab completion for dotsecenv commands in Bash by evaluating the completion script. This can be added to your ~/.bashrc or installed system-wide.

```bash
# Add to ~/.bashrc
eval "$(dotsecenv completion bash)"

# Or install system-wide
dotsecenv completion bash | sudo tee /etc/bash_completion.d/dotsecenv
```

--------------------------------

### Configure GPG Program Path

Source: https://dotsecenv.com/reference

Examples demonstrating how to configure the GPG program path in dotsecenv. This can be set to infer from the system PATH, use an absolute path, or specify a Windows executable path.

```yaml
# Infer from system PATH (recommended default)
gpg:
  program: PATH
```

```yaml
# Explicit absolute path
gpg:
  program: /usr/bin/gpg
```

```yaml
# Windows
gpg:
  program: "C:\\Program Files (x86)\\GnuPG\\bin\\gpg.exe"
```

--------------------------------

### Store namespaced secrets

Source: https://dotsecenv.com/tutorials/first-secret

Organize secrets by environment using namespaces. This example stores production and staging database passwords.

```bash
echo "prod-password" | dotsecenv secret store prod::DATABASE_PASSWORD
echo "staging-password" | dotsecenv secret store staging::DATABASE_PASSWORD
```

--------------------------------

### dotsecenv Output with Policy Warnings

Source: https://dotsecenv.com/concepts/policy-directory

Example output from `dotsecenv vault describe` showing warnings generated when policy settings conflict with or restrict user configurations.

```text
warning: policy excludes RSA from your approved_algorithms
warning: policy raises min_bits for ECC from 256 to 384
warning: policy and your approved_algorithms have no common curves for ECC; this algorithm is now unusable
warning: policy filters vault path /home/alice/personal-secrets/vault (not matched by approved_vault_paths: [/srv/secrets/*/vault])

```

--------------------------------

### Install Bash shell plugin

Source: https://dotsecenv.com/tutorials/first-secret

Add the dotsecenv shell plugin and auto-load hook to your ~/.bashrc file. Reload your shell after adding.

```bash
# dotsecenv shell plugin
eval "$(dotsecenv completion bash)"

# Auto-load .secenv files
_dotsecenv_hook() {
  if [[ -f .secenv ]]; then
    eval "$(dotsecenv env load)"
  fi
}
if ! [[ "${PROMPT_COMMAND:-}" =~ _dotsecenv_hook ]]; then
  PROMPT_COMMAND="_dotsecenv_hook${PROMPT_COMMAND:+
$PROMPT_COMMAND}"
fi
```

--------------------------------

### Initialize dotsecenv with Defaults

Source: https://dotsecenv.com/guides/github-action

Run `dotsecenv init config` with default settings by setting `init-config` to an empty string.

```yaml
- uses: dotsecenv/dotsecenv@v0
      with:
        init-config: ''
```

--------------------------------

### Install Zsh shell plugin

Source: https://dotsecenv.com/tutorials/first-secret

Add the dotsecenv shell plugin and auto-load hook to your ~/.zshrc file. Reload your shell after adding.

```zsh
# dotsecenv shell plugin
eval "$(dotsecenv completion zsh)"

# Auto-load .secenv files
autoload -U add-zsh-hook
_dotsecenv_hook() {
  if [[ -f .secenv ]]; then
    eval "$(dotsecenv env load)"
  fi
}
add-zsh-hook chpwd _dotsecenv_hook
```

--------------------------------

### Quick secret retrieval with `dse get`

Source: https://dotsecenv.com/guides/shell-plugins

Use `dse get NAME` to quickly retrieve a secret without typing the full `dotsecenv secret get` command.

```bash
# Instead of:
dotsecenv secret get DATABASE_PASSWORD

# Use:
dse get DATABASE_PASSWORD
```

--------------------------------

### List Policy Output

Source: https://dotsecenv.com/concepts/policy-directory

Example output of the `dotsecenv policy list` command, showing the merged policy with per-field origin attribution from different fragments.

```text
$ dotsecenv policy list
Policy directory: /etc/dotsecenv/policy.d (2 fragment(s))
  approved_algorithms:
    - algo: ECC, curves: [P-384, P-521], min_bits: 384  [50-org-baseline.yaml]
  approved_vault_paths:
    - /srv/secrets/*/vault  [50-org-baseline.yaml]
  behavior:
    restrict_to_configured_vaults: true  [50-org-baseline.yaml]
  gpg.program: /usr/bin/gpg  [99-overrides.yaml]
```

--------------------------------

### Production / CI Environment Configuration

Source: https://dotsecenv.com/concepts/behavior-settings

Example configuration for a production or CI environment, enforcing stricter settings like `restrict_to_configured_vaults` and specific algorithms.

```yaml
approved_algorithms:
  - algo: ECC
    curves: [P-384, P-521]
    min_bits: 384
vault:
  - /secure/path/to/vault
behavior:
  restrict_to_configured_vaults: true
gpg:
  program: /usr/bin/gpg
```

--------------------------------

### Multi-Vault Configuration Example

Source: https://dotsecenv.com/concepts/architecture

Specifies multiple vault locations with optional names for easier management. Access vaults by name or 1-based index.

```yaml
vault:
  - name: personal
    path: ~/.config/dotsecenv/vault
  - name: work
    path: ~/work/secrets/vault
```

--------------------------------

### Activate Dotsecenv Shell Plugin for Fish

Source: https://dotsecenv.com/getting-started

Manually link the dotsecenv Fish plugin if the installer did not do so automatically. This ensures Fish can find the plugin.

```bash
ln -sf ~/.local/share/dotsecenv/plugin/conf.d/dotsecenv.fish ~/.config/fish/conf.d/dotsecenv.fish
```

--------------------------------

### Option 2: Jump Directly and Use `dse up`

Source: https://dotsecenv.com/guides/shell-plugins

Demonstrates loading secrets by using `dse up` to walk up the directory tree when you initially jump into a subdirectory.

```text
~ $ cd myapp/terraform/      # Jumped directly; parent .secenv not loaded
~/myapp/terraform $ echo $DATABASE_URL
                              # Empty; secrets not loaded

~/myapp/terraform $ dse up    # Walk up, find and load ancestor .secenv files
dotsecenv: loaded 2 secret(s) from .secenv: DATABASE_URL, API_KEY

~/myapp/terraform $ echo $DATABASE_URL
postgres://...               # Now available!
```

--------------------------------

### Using GitHub Action Outputs

Source: https://dotsecenv.com/guides/github-action

Access outputs from the dotsecenv action, such as the installed version and binary path, for use in subsequent steps. Assign an `id` to the action step to reference its outputs.

```yaml
- uses: dotsecenv/dotsecenv@v0
  id: dotsecenv

- name: Show installed version
  run: |
    echo "Installed version: ${{ steps.dotsecenv.outputs.version }}"
    echo "Binary path: ${{ steps.dotsecenv.outputs.binary-path }}"
```

--------------------------------

### Initialize Config with Sudo

Source: https://dotsecenv.com/how-to

Use this command if you encounter a 'Config error running as root' to correctly initialize the configuration when running as root.

```bash
sudo dotsecenv init config
```

--------------------------------

### Tree-Scoped Secret Loading Example

Source: https://dotsecenv.com/guides/shell-plugins

Illustrates how secrets remain loaded when navigating subdirectories within the same project tree and are unloaded only when leaving the entire tree.

```text
~/project $ cd myapp/
dotsecenv: loaded 2 secret(s) from .secenv: DATABASE_URL, API_KEY

~/project/myapp $ cd src/components/
# Secrets still available - we're in the myapp tree

~/project/myapp/src/components $ echo $DATABASE_URL
postgres://...

~/project/myapp/src/components $ cd ~/other-project/
dotsecenv: unloaded 2 secret(s): DATABASE_URL, API_KEY
# Secrets unloaded - we left the myapp tree
```

--------------------------------

### Generate Fish shell completion scripts

Source: https://dotsecenv.com/reference

Generate shell completion scripts for Fish. Instructions are provided for loading completions for the current session or installing them permanently.

```bash
# Load for current session
dotsecenv completion fish | source

# Install permanently
dotsecenv completion fish > ~/.config/fish/completions/dotsecenv.fish
```

--------------------------------

### Initialize and Login with Fingerprint

Source: https://dotsecenv.com/getting-started

A shortcut to initialize the dotsecenv configuration and vault, and log in simultaneously by providing your GPG key fingerprint.

```bash
dotsecenv init config --login YOUR_FINGERPRINT
```

--------------------------------

### Build dotsecenv from Source

Source: https://dotsecenv.com/tutorials/installation

Build dotsecenv from source using Go 1.25+. This involves cloning the repository, running the build command, and moving the binary to your PATH.

```bash
git clone https://github.com/dotsecenv/dotsecenv.git
cd dotsecenv
make build
sudo mv bin/dotsecenv /usr/local/bin/
```

--------------------------------

### Initialize Config

Source: https://dotsecenv.com/how-to

Run this command if you encounter a 'Config not found' error to initialize the dotsecenv configuration.

```bash
dotsecenv init config
```

--------------------------------

### Initialize dotsecenv Configuration and Vault

Source: https://dotsecenv.com/

Initializes the dotsecenv configuration file and vault, then logs in by selecting a GPG key.

```bash
dotsecenv init config
dotsecenv init vault
dotsecenv login   # select your GPG key interactively
```

--------------------------------

### Set Up Fish Shell Completions

Source: https://dotsecenv.com/how-to

Enable tab completion for dotsecenv commands in Fish shell by sourcing the completion script. Add this to your ~/.config/fish/config.fish file.

```bash
# Add to ~/.config/fish/config.fish
dotsecenv completion fish | source
```

--------------------------------

### Basic dotsecenv Usage

Source: https://dotsecenv.com/reference

Shows the general structure for running dotsecenv commands and flags.

```bash
dotsecenv [flags]
dotsecenv [command]
```

--------------------------------

### Login with GPG Key

Source: https://dotsecenv.com/reference

Initializes your dotsecenv identity by selecting a GPG key. This creates a signed proof of control over the secret key.

```bash
# Interactive key selection (recommended)
dotsecenv login

# Specify fingerprint directly
dotsecenv login E60A1740BAEF49284D22EA7D3C376348F0921C59
```

--------------------------------

### Delete Secret by Vault Path

Source: https://dotsecenv.com/reference

Use this command to delete a specific secret from a vault located at a given path. After deletion, 'secret get' will return an error, 'secret get --all' will skip the deleted secret, and 'secret get --last' will not consider it. 'vault describe' will show the secret as (deleted).

```bash
dotsecenv secret forget -v ./project/vault SECRET_NAME
```

--------------------------------

### Get Vault Doctor JSON Output

Source: https://dotsecenv.com/how-to

Use the --json flag to get machine-readable output from the vault doctor command, suitable for CI environments.

```bash
dotsecenv vault doctor --json
```

--------------------------------

### Initialize dotsecenv with Login Flag

Source: https://dotsecenv.com/guides/github-action

Initialize dotsecenv configuration using the `--login` flag, specifying a GPG key. Replace `<GPG_KEY>` with your actual GPG key identifier.

```yaml
- uses: dotsecenv/dotsecenv@v0
      with:
        init-config: '--login <GPG_KEY>'
```

--------------------------------

### Create .secenv file

Source: https://dotsecenv.com/tutorials/first-secret

Create a .secenv file in your project directory to define secrets. Supports direct loading, specific secret loading, and namespaced secret loading.

```bash
cd ~/my-project

cat > .secenv << 'EOF'
# Secrets loaded from dotsecenv vault
DATABASE_PASSWORD={dotsecenv}
API_KEY={dotsecenv/prod::API_KEY}
EOF
```

--------------------------------

### Verify GPG Key from Keybase

Source: https://dotsecenv.com/tutorials/installation

Import the dotsecenv release GPG key using Keybase to verify package authenticity.

```bash
curl https://keybase.io/dotsecenv/pgp_keys.asc | gpg --import
```

--------------------------------

### Set Up Zsh Shell Completions

Source: https://dotsecenv.com/how-to

Enable tab completion for dotsecenv commands in Zsh by evaluating the completion script. Add this to your ~/.zshrc file.

```bash
# Add to ~/.zshrc
eval "$(dotsecenv completion zsh)"
```

--------------------------------

### Initialize dotsecenv with Custom GPG Program

Source: https://dotsecenv.com/guides/github-action

Specify a custom path to the GPG binary for initialization using the `init-config` input. This overrides the default behavior of resolving GPG from the runner's PATH.

```yaml
- uses: dotsecenv/dotsecenv@v0
      with:
        init-config: '--gpg-program /usr/bin/gpg'
```

--------------------------------

### Uninstall dotsecenv via Homebrew

Source: https://dotsecenv.com/tutorials/installation

Remove dotsecenv and its associated tap if installed using Homebrew.

```bash
brew uninstall dotsecenv
brew untap dotsecenv/tap
```

--------------------------------

### Show version information (JSON Output)

Source: https://dotsecenv.com/reference

To retrieve version information in a structured JSON format, use the `version --json` command. This output is suitable for programmatic consumption and includes detailed build and crypto information.

```json
{
  "version": "v0.2.1",
  "commit": "abc1234",
  "builtAt": "2025-01-15T10:30:00Z",
  "goBuildVersion": "go1.24.0",
  "crypto": {
    "GOFIPS140": "v1.26.0",
    "fips140Enabled": true
  }
}
```

--------------------------------

### Commit Plaintext Secrets Example

Source: https://dotsecenv.com/

Demonstrates the risk of accidentally committing plaintext secrets to a Git repository.

```bash
echo "AWS_SECRET_ACCESS_KEY=AKIA..." >> .env
git add . && git commit -m "update config"
git push
# Credentials accidentally pushed to a public repo.
```

--------------------------------

### Get Secret in GitHub Actions

Source: https://dotsecenv.com/how-to

Retrieve a secret from dotsecenv and export it as an environment variable for use in your deployment script.

```bash
export DATABASE_PASSWORD=$(dotsecenv secret get DATABASE_PASSWORD)
```

--------------------------------

### Get Latest Secret Value

Source: https://dotsecenv.com/tutorials/first-secret

Retrieve the most recent version of a specific secret. Ensure you have the correct secret name.

```bash
dotsecenv secret get --last DATABASE_PASSWORD
```

--------------------------------

### Option 1: Navigate Through Parent Directory

Source: https://dotsecenv.com/guides/shell-plugins

Shows how secrets auto-load and persist when you first `cd` into the directory containing `.secenv` and then navigate deeper.

```text
~ $ cd myapp/                # .secenv loads here
dotsecenv: loaded 2 secret(s) from .secenv: DATABASE_URL, API_KEY

~/myapp $ cd terraform/      # Secrets persist; still in the myapp tree
~/myapp/terraform $ echo $DATABASE_URL
postgres://...               # Available!
```

--------------------------------

### Configure .env and .secenv Files

Source: https://dotsecenv.com/how-to

Use .env for non-sensitive configuration and .secenv for encrypted secrets. Variables from .secenv override .env if names match.

```bash
# .env: non-sensitive configuration
DATABASE_HOST=localhost
DATABASE_PORT=5432
DATABASE_NAME=myapp
LOG_LEVEL=debug

# .secenv: encrypted secrets from vault
DATABASE_PASSWORD={dotsecenv}
API_KEY={dotsecenv/prod::API_KEY}
```

--------------------------------

### Create .secenv File

Source: https://dotsecenv.com/getting-started

Create a .secenv file in your project directory. This file instructs the dotsecenv shell plugin to automatically load specified secrets when you enter the directory.

```bash
mkdir -p ~/my-project
echo 'DATABASE_PASSWORD={dotsecenv}' > ~/my-project/.secenv
```

--------------------------------

### Shared Team Environment Configuration

Source: https://dotsecenv.com/concepts/behavior-settings

Example configuration for a shared team environment, requiring explicit vault upgrades to coordinate changes.

```yaml
approved_algorithms:
  - algo: RSA
    min_bits: 4096
vault:
  - ~/projects/myapp/.dotsecenv/vault
behavior:
  require_explicit_vault_upgrade: true  # Coordinate upgrades
gpg:
  program: PATH
```

--------------------------------

### Initialize dotsecenv with Login Identity (GPG Fingerprint)

Source: https://dotsecenv.com/guides/github-action

Configure dotsecenv initialization to use a specific GPG fingerprint for login. Replace `YOUR_GPG_FINGERPRINT` with the actual fingerprint.

```yaml
- uses: dotsecenv/dotsecenv@v0
      with:
        init-config: '--login YOUR_GPG_FINGERPRINT'
```

--------------------------------

### Get Secret in GitLab CI

Source: https://dotsecenv.com/how-to

Retrieve a secret using dotsecenv and set it as an environment variable for subsequent script execution in GitLab CI.

```bash
export API_KEY=$(dotsecenv secret get API_KEY)
```

--------------------------------

### Configure dotsecenv Initialization

Source: https://dotsecenv.com/guides/github-action

Use the `init-config` input to initialize dotsecenv with default settings or specific flags. Set to an empty string for defaults.

```yaml
        - uses: dotsecenv/dotsecenv@v0
          with:
            init-config: ''
```

--------------------------------

### Retrieve a Decrypted Secret

Source: https://dotsecenv.com/how-to

Get a decrypted secret value from the vault. Options include retrieving as JSON, all historical versions, or the latest version only.

```bash
dotsecenv secret get DATABASE_PASSWORD
# Output: my-secret-value
```

```bash
dotsecenv secret get DATABASE_PASSWORD --json
# {"name":"DATABASE_PASSWORD","value":"my-secret-value","available_to":["..."]}
```

```bash
dotsecenv secret get DATABASE_PASSWORD --all
# Lists all historical values
```

```bash
dotsecenv secret get DATABASE_PASSWORD --last
```

```bash
dotsecenv secret get -v 2 DATABASE_PASSWORD  # Vault index (1-based)
dotsecenv secret get -v ./path/to/vault DATABASE_PASSWORD
```

--------------------------------

### Initialize Dotsecenv Configuration and Vault

Source: https://dotsecenv.com/getting-started

Initialize the dotsecenv configuration and vault. This sets up the necessary files and structures for managing secrets.

```bash
dotsecenv init config
dotsecenv init vault
```

--------------------------------

### Load Plugin for Local Development

Source: https://dotsecenv.com/guides/claude-code

Use this command to load the dotsecenv plugin directly from a local checkout for development purposes. Ensure the path points to your local dotsecenv directory.

```bash
claude --plugin-dir /path/to/dotsecenv
```

--------------------------------

### Get GPG Key Fingerprint

Source: https://dotsecenv.com/tutorials/team-onboarding

If you encounter an 'identity not found' error, use this command to retrieve your GPG key fingerprint to provide to your team lead.

```bash
gpg --list-keys --keyid-format long you@example.com
```

--------------------------------

### Verify and test dotsecenv helper

Source: https://dotsecenv.com/guides/terraform-credentials-helper

Confirm the dotsecenv credentials helper binary exists and is executable in the plugin directory. Perform a quick smoke test by retrieving credentials for a host, which should return an empty JSON object if no credentials are stored.

```bash
ls -l ~/.terraform.d/plugins/terraform-credentials-dotsecenv
```

```bash
~/.terraform.d/plugins/terraform-credentials-dotsecenv get app.terraform.io
# Should print: {}
```

--------------------------------

### JSON Example of 'available_to' Field

Source: https://dotsecenv.com/concepts/architecture

Illustrates the structure of the 'available_to' field within a JSON object, which specifies the fingerprints of users authorized to decrypt a value.

```json
{
  "available_to": [
    "E60A1740BAEF49284D22EA7D3C376348F0921C59",
    "ABC123DEF456789012345678901234567890ABCD"
  ]
}
```

--------------------------------

### Verify GPG Key from Keyserver

Source: https://dotsecenv.com/tutorials/installation

Import the dotsecenv release GPG key from a public keyserver to verify package authenticity.

```bash
gpg --keyserver keys.openpgp.org --recv-keys E60A1740BAEF49284D22EA7D3C376348F0921C59
```

--------------------------------

### Initialize Vault

Source: https://dotsecenv.com/how-to

Run this command if you encounter a 'Vault not found' error to initialize a new dotsecenv vault.

```bash
dotsecenv init vault
```
Tokens:
Raw