Secret management for development and CI
Load secrets from encrypted files, password managers, and cloud services into your application’s environment. Configure where each value comes from in fnox.toml.
mise use -g fnoxOpen source · MIT licensed · Built in Rust
fnox.toml # Connect the vault you already use
[providers.op]
type = "1password"
vault = "Engineering"
[secrets.DATABASE_URL]
provider = "op"
value = "Database/url"$ fnox exec -- npm startDATABASE_URL is available to your app.
Commit the vault reference without putting the secret value in git.
Choose where secrets are stored
Each secret can use a different provider, so you can combine encrypted values with references to your team’s existing vaults.
Encrypted values in git
Encrypt with age, a hardware key, or cloud KMS. Review configuration alongside your code and share access through public recipients or provider permissions.
Start with ageExisting vaults
Reference the secrets your team already manages. Add a personal encrypted cache with fnox sync for local, offline access using age.
Connect a vaultEnvironment profiles
Use profiles for development, staging, and production. Change the secret source without changing the way you launch your application.
Work with profilesUse secrets in your workflow
Load secrets when you enter a project, cache repeated reads, or issue temporary credentials when a service supports them.
See how fnox worksShell integration
Shell hooks load and unload values as you move between projects.
In-memory caching
An opt-in daemon keeps resolved values in memory during your session.
Temporary credentials
Create temporary credentials with AWS STS, GitHub Apps, Vault, and more.
Credentials for agent requests
Pass placeholders to an agent and inject real values into matching HTTPS requests.
Set up your first provider
Install fnox, configure a provider, and run your first command.