.env file with one command.
Sink is hosted at usesink.co and the API at api.usesink.co and is currently in public beta.
What Sink does
Sync .env files
sink pull, sink diff and sink push move values between an environment and a local file. Files land 0600, values print masked.Keep environments apart
Development never reads production’s values. Each environment is its own set of secrets, with its own members.
Encrypt every value
Each secret gets its own data encryption key, wrapped under the deployment’s master key. Neither the plaintext nor the raw key is stored.
Share without accounts
Hand someone a link that expires on a timer and dies after a set number of views. No Sink account needed on the other end.
Import what you already have
Pull variables straight out of Railway, Vercel or Render. The provider token is used for that one request and never stored.
Keep the history
Every update mints a new version, and every read, write and share is written to an audit log.
Pick a starting point
Quickstart
Install the CLI, link a directory and pull your first environment — about five minutes.
Core concepts
How workspaces, teams, projects, environments and versions fit together.
CLI reference
Every command and flag, including CI patterns.
API reference
The REST API behind the dashboard and the CLI.
For agents and LLM tooling
Sink publishes a machine-readable summary of the product, the API surface and the CLI at usesink.co/llms.txt. Point a coding agent at it rather than at the dashboard.A note on masking
Sink masks secret values in CLI output by default and only reveals them when you pass--show-values. Files written by sink pull are created readable by you and nobody else. Neither is a substitute for keeping .env out of version control.