Commit the .env. Keep the secrets.

Write references like keepass(…) or awssm(…) into a .env.tpl, check it into git, and let tplenv resolve them when your process starts. The values come from KeePass, your OS credential store or your cloud vault, and an AI agent working in your repository only ever sees the references.

Install Source on GitHub

.env.tpl

DATABASE_URL=keepass(&personal|/Dev/postgres)••••••••••••••KeePass AWS_SECRET_ACCESS_KEY=awssm(MyApp/Prod|secret_key)••••••••••••AWS GH_TOKEN=op(Private/GitHub Token|credential)••••••••••1Password DEPLOY_TOKEN=user(Enter deploy token)••••••••typed in APP_ENV=production

This is the whole file. Nothing in it unlocks anything, so it can sit in your repository next to the code.

See it in action

From a template in git to resolved values in your process, shared across a team, with an approval dialog you can turn on for every read.

Music: “Happy Beats / Business Moves Vol. 12” by ende.app, CC BY 4.0.

How it works

Three steps, and the second one is the only command you type.

Write a .env.tpl

Replace each credential with a reference to where it lives. Plain values stay as they are. Everyone on the team uses the same file; each person's own vault supplies their credentials.
Start your command through tplenv

A background process opens the vaults the template needs. You unlock a vault once, and it stays open for the time you set in the tray settings.
tplenv run npm start
Your program starts with the variables set

The resolved values go straight into the environment of the program you started. They are never written to a file.

Working with AI coding agents

An agent reads your repository, runs your commands and needs API keys to do it. Give it the keys it needs and nothing it can stumble on.

The agent reads your project

It opens every file it thinks is relevant, .env.tpl included. All it finds there is where a key lives, never the key.
what the agent sees in .env.tpl
```
OPENAI_API_KEY=keepass(&personal|/AI/OpenAI)
STRIPE_KEY=awssm(Shop/Stripe|test_key)
```
You start it with the keys it needs

Launch the agent through tplenv run. The resolved values sit in its environment, so the agent and every command it starts can use them.
your terminal
```
tplenv run your-agent
# inside the agent's session
OPENAI_API_KEY=••••••••••••
```
It asks for more, you decide

With approvals turned on, an agent that calls getsec on its own gets nothing until you answer this dialog. It shows which program asked and for which secret. Each decision is written to audit.log. The hardened build also asks for Windows Hello or a security key.

DesktopSecrets

Allow secret access?

Process:
C:\Program Files\Git\usr\bin\bash.exe

Secret reference:
keepass(&cloud|/AWS/Prod/secret-key)

Where secrets can come from

Mix sources freely in one template. Each line resolves on its own.

Reference	Reads from	Runs on	Example
`keepass`	KeePass `.kdbx` vaults, with wildcards, attributes, aliases and chained unlocking	All	`keepass(vault.kdbx\|/AWS/Prod/key)`
`wincred`	Windows Credential Manager	Windows	`wincred(MyApp/DBPassword\|username)`
`keychain`	macOS login keychain	macOS	`keychain(MyApp\|alice)`
`awssm`	AWS Secrets Manager, with JSON field selection	All	`awssm(MyApp/DB\|password)`
`awsps`	AWS Parameter Store, SecureString included	All	`awsps(/myapp/prod/api-key)`
`azkv`	Azure Key Vault	All	`azkv(my-vault/db-password)`
`gcpsm`	Google Cloud Secret Manager	All	`gcpsm(my-project/api-key)`
`vault`	HashiCorp Vault KV, with token or AppRole login	All	`vault(secret/data/myapp\|password)`
`op`	1Password, through the signed-in `op` CLI	All	`op(Private/GitHub Token\|credential)`
`user`	A prompt window; the value is typed in and stored nowhere	All	`user(Enter deploy token)`

Cloud sources use their standard sign-in, such as the AWS credential chain, an Azure CLI login or gcloud credentials. Full reference syntax in the README

What you get

Nothing to leak from the disk: Backups, synced folders and a careless git add . only ever see references.
One unlock per session: Enter a master password once. The vault stays open for the time you choose, then locks again.
Approve each read if you want to: Turn on a confirmation dialog for every retrieval. The hardened build asks for Windows Hello or a security key each time.
Load into your current shell: tplenv --apply-one-liner prints the command that sets the variables in the shell you are in, for sh, PowerShell and cmd.
One secret at a time: getsec resolves a single reference, handy in scripts and CI steps.

Aliases and chained vaults

Give vault files short names, and let one vault hold the master password of another. You unlock the first; the rest follow.

aliases.yaml

personal: C:\Vaults\personal.kdbx

cloud:
  file: C:\Vaults\cloud.kdbx
  master: keepass(&personal|Cloud Master)

.env.tpl

# opens personal.kdbx first, then cloud.kdbx with the password stored there
SECRET=keepass(&cloud|/Prod/api-key)

Install

The script downloads the latest release, checks it against the published SHA256 sums and puts tplenv and getsec on your PATH.

Windows

irm https://it-atelier-gn.github.io/desktop-secrets/install.ps1 | iex

Linux

curl -fsSL https://it-atelier-gn.github.io/desktop-secrets/install.sh | bash

Read the scripts before you run them: install.ps1, install.sh. Binaries for Windows and Linux (x64), including the hardened variant, are on the releases page.

To use DesktopSecrets from Go, run go get github.com/it-atelier-gn/desktop-secrets and follow the library notes.

Commit the .env. Keep the secrets.

Write a .env.tpl

Start your command through tplenv

Your program starts with the variables set

The agent reads your project

You start it with the keys it needs

It asks for more, you decide