Skip to main content
Sink is a hosted secret manager for development teams. Every value is stored under AES-256-GCM envelope encryption, organised as workspaces → teams → projects → environments, and synced to a local .env file with one command.
Sink is hosted at usesink.co and the API at api.usesink.co and is currently in public beta.

What Sink does

Sync .env files

sink pull, sink diff and sink push move values between an environment and a local file. Files land 0600, values print masked.

Keep environments apart

Development never reads production’s values. Each environment is its own set of secrets, with its own members.

Encrypt every value

Each secret gets its own data encryption key, wrapped under the deployment’s master key. Neither the plaintext nor the raw key is stored.

Share without accounts

Hand someone a link that expires on a timer and dies after a set number of views. No Sink account needed on the other end.

Import what you already have

Pull variables straight out of Railway, Vercel or Render. The provider token is used for that one request and never stored.

Keep the history

Every update mints a new version, and every read, write and share is written to an audit log.

Pick a starting point

Quickstart

Install the CLI, link a directory and pull your first environment — about five minutes.

Core concepts

How workspaces, teams, projects, environments and versions fit together.

CLI reference

Every command and flag, including CI patterns.

API reference

The REST API behind the dashboard and the CLI.

For agents and LLM tooling

Sink publishes a machine-readable summary of the product, the API surface and the CLI at usesink.co/llms.txt. Point a coding agent at it rather than at the dashboard.

A note on masking

Sink masks secret values in CLI output by default and only reveals them when you pass --show-values. Files written by sink pull are created readable by you and nobody else. Neither is a substitute for keeping .env out of version control.