Sync

These three commands move secrets between your local .env.local and Klef. All encryption and decryption happens on your machine.

klef push

Encrypt the local .env.local and upload it to the current project's environment.

klef push

Each value is encrypted with the environment key before it leaves your machine.

Flag	Description
`-e, --env <name>`	Override the environment from `.klef`.

klef push --env production

Fetch the current environment, decrypt it, and merge it into .env.local.

klef pull

klef pull is a smart merge, not a destructive overwrite:

It preserves the order, comments, and blank lines in your existing .env.local.
It updates values that changed on the server.
It appends new remote keys at the end.
It drops keys that were removed remotely, printing a warning for each.

By default it shows a diff and asks for confirmation before writing. Skip the prompt with --force.

Flag	Description
`-f, --force`	Skip the confirmation prompt and write immediately.
`-e, --env <name>`	Override the environment from `.klef`.

klef pull --force
klef pull --env staging

Compare your local .env.local against the server without applying any changes. Useful before a push or pull to see exactly what would change.

klef diff

Flag	Description
`-e, --env <name>`	Override the environment from `.klef`.

klef diff --env production