Import from a provider

Sink reads environment variables directly out of Railway, Vercel and Render so you do not have to copy them by hand.

Provider import is a paid capability — the whole route group is gated, so an unentitled call answers 402. See Plans and limits.

Your provider token is used for the request that needs it and nothing else. It is never written to Sink’s database, the CLI config file, or your keychain.

With the CLI

sink import railway prod

With nothing but the provider name, the CLI asks the token for what it can see and walks you through picking a project, environment and service. Every import previews before it writes:

sink import vercel prod --project prj_abc --provider-env production --dry-run
sink import render prod --service srv_1 --mode overwrite --yes

Flag	Description
`-t, --token`	Provider token. `-` reads it from stdin; otherwise `SINK_RAILWAY_TOKEN`, `SINK_VERCEL_TOKEN` or `SINK_RENDER_TOKEN`, then a hidden prompt.
`--project`	Provider project. For Render, the service.
`--provider-env`	Railway environment, or Vercel target.
`--service`	Railway or Render service. On Railway, omitting it imports the environment’s shared variables.
`--mode skip\|overwrite`	What to do with keys Sink already has. Default `skip`.
`--dry-run`	Show the plan and stop.
`-y, --yes`	Skip the confirmation. Required when not attached to a terminal.
`--show-values`	Print values in clear text in the preview. Masked otherwise.

skip vs overwrite

skip creates the keys Sink does not have and leaves everything else alone — the safe default for a first import. overwrite also applies the provider’s value to keys that differ, which mints a new version of each one rather than replacing history. Variables the provider will not hand back in clear text (sealed or reference values, for instance) are reported as skipped, with a reason, so a short import is never a silent one.

With the API

Discover what a token can reach

POST /integrations/providers/{provider}/projects

{ "token": "provider_token" }

The response lists each project with its environments and services, in the provider’s own vocabulary.

Preview, then apply

Both routes hang off one base path:

/integrations/{workspace_id}/{team_id}/{project_id}/{environment_id}

Method	Path	Purpose
`POST`	`/preview`	Work out the create / update / skip plan. Changes nothing.
`POST`	`/`	Apply it. Returns `created`, `updated`, `unchanged` and `skipped`.

Preview request

{
  "provider": "vercel",
  "token": "provider_token",
  "source": {
    "project_id": "prj_abc",
    "target": "production"
  },
  "reveal": false
}

Sending the same body with "mode": "skip" or "mode": "overwrite" to the base path applies it. reveal controls whether preview values come back in clear text or masked.

Addressing each provider

Railway
Vercel
Render

{ "project_id": "…", "environment_id": "…", "service_id": "…" }

service_id is optional — leave it out to read the environment’s shared variables.

{ "project_id": "prj_…", "target": "production" }

target is production, preview or development.

{ "project_id": "srv_…" }

Render addresses a service directly; pass the service id as project_id or service_id.

After the import

Pull the environment down and check it reads the way you expect:

sink pull prod --stdout

Then delete the variables from the provider’s dashboard, so there is one place they live.

Getting Started

Guides

Security & Access

CLI Reference

API Reference

Import from a provider

With the CLI

skip vs overwrite

With the API

Discover what a token can reach

Preview, then apply

Addressing each provider

After the import

​With the CLI

​skip vs overwrite

​With the API

​Discover what a token can reach

​Preview, then apply

​Addressing each provider

​After the import

With the CLI

skip vs overwrite

With the API

Discover what a token can reach

Preview, then apply

Addressing each provider

After the import