> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usesink.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Sink

> Secret management without ceremony.

Sink is a hosted secret manager for development teams. Every value is stored under AES-256-GCM envelope encryption, organised as **workspaces → teams → projects → environments**, and synced to a local `.env` file with one command.

```bash theme={null}
curl -fsSL https://usesink.co/install.sh | sh
sink login
sink init
sink pull
```

<Note>
  Sink is hosted at [usesink.co](https://usesink.co) and is currently in public beta.
</Note>

## What Sink does

<CardGroup cols={2}>
  <Card title="Sync .env files" icon="arrows-rotate" href="/cli/reference">
    `sink pull`, `sink diff` and `sink push` move values between an environment and a local file. Files land `0600`, values print masked.
  </Card>

  <Card title="Keep environments apart" icon="layer-group" href="/concepts">
    Development never reads production's values. Each environment is its own set of secrets, with its own members.
  </Card>

  <Card title="Encrypt every value" icon="lock" href="/security/encryption">
    Each secret gets its own data encryption key, wrapped under the deployment's master key. Neither the plaintext nor the raw key is stored.
  </Card>

  <Card title="Share without accounts" icon="link" href="/guides/sharing">
    Hand someone a link that expires on a timer and dies after a set number of views. No Sink account needed on the other end.
  </Card>

  <Card title="Import what you already have" icon="cloud-arrow-down" href="/guides/importing">
    Pull variables straight out of Railway, Vercel or Render. The provider token is used for that one request and never stored.
  </Card>

  <Card title="Keep the history" icon="clock-rotate-left" href="/security/audit">
    Every update mints a new version, and every read, write and share is written to an audit log.
  </Card>
</CardGroup>

## Pick a starting point

<Columns cols={2}>
  <Card title="Quickstart" icon="rocket" href="/quickstart">
    Install the CLI, link a directory and pull your first environment — about five minutes.
  </Card>

  <Card title="Core concepts" icon="sitemap" href="/concepts">
    How workspaces, teams, projects, environments and versions fit together.
  </Card>

  <Card title="CLI reference" icon="terminal" href="/cli/reference">
    Every command and flag, including CI patterns.
  </Card>

  <Card title="API reference" icon="code" href="/api/authentication">
    The REST API behind the dashboard and the CLI.
  </Card>
</Columns>

## For agents and LLM tooling

Sink publishes a machine-readable summary of the product, the API surface and the CLI at [usesink.co/llms.txt](https://usesink.co/llms.txt). Point a coding agent at it rather than at the dashboard.

## A note on masking

Sink masks secret values in CLI output by default and only reveals them when you pass `--show-values`. Files written by `sink pull` are created readable by you and nobody else. Neither is a substitute for keeping `.env` out of version control.