Skip to main content
By the end of this page a local directory is linked to a Sink project and its .env file is coming from Sink.
1

Create an account

Sign up at usesink.co/auth/signup with email and password, Google, or GitHub. Signing up creates your first workspace for you.
2

Install the CLI

The installer reads /cli/manifest.json, verifies the wheel’s checksum against it, and links sink into ~/.local/bin. Because the script is served by the deployment it installs a client for, the version always matches the server.
If sink is not found afterwards, add ~/.local/bin to your PATH.
3

Create an API key

In the dashboard, open API Keys and create one. Keys begin with sk-; treat them like a password. The token is shown once, at creation.
4

Log in

Paste the key when prompted. Sink stores it in your OS keychain; where no keychain backend exists it falls back to ~/.config/sink/config.json, written readable only by you.
confirms the account, the API URL and where the credential is being read from.
5

Link the directory

From the repository that should receive the secrets:
With no flags it walks you through picking a workspace, team, project and default environment. To skip the prompts:
This writes .sink.json — ids and display names, no values. It is safe to commit, and pull, push and diff find it by walking up from the current directory.
.sink.json
6

Sync

Each command takes an optional environment name to override the linked default: sink pull staging.Files written by pull are created 0600. push shows you the plan — creates, updates, and what it is leaving alone — and waits for a yes before writing anything.

​
Bringing existing variables in

If your values currently live on a hosting provider, import them rather than copying by hand:
The provider token is used for that one request and is never written to disk. See Import from a provider.

​
Running in CI

Don’t run sink login in a pipeline. Set two environment variables instead:
SINK_API_KEY takes precedence over anything stored on disk or in a keychain. Secrets in CI covers the full pattern, including drift checks.

​
Next steps

Core concepts

What a workspace, team, project and environment each hold.

CLI reference

Every command and flag.

Security model

How values are encrypted, and what Sink can and cannot see.

Plans and limits

What each tier allows.