Product documentation

Build with confidence.
Keep secrets in sync.

A practical guide to Shroud's web dashboard, team access, environments, and command-line workflow.

First steps

Getting started

Belong to multiple workspaces

Open the workspace menu at the top of the sidebar to switch teams, create another workspace, or join one with an invitation link or token. Joining preserves your existing memberships. Each workspace has separate projects, members, tokens, activity, and roles.

Sign in with Google or create an account using an email address and password. If prompted, confirm your email using the link in your inbox before signing in.

Sign in and create a team in onboarding. New workspaces start empty. Click New project to create a project with Development, Staging, and Production environments.
Open a project and choose an environment. Add a secret with a key such as DATABASE_URL and its value.
Open Terminal in the dashboard. Enter a project with shroud use and an environment with shroud env. Add a variable with shroud push KEY "value" or read one with shroud pull KEY. No installation or API token is required.

Dashboard

Using the web app

Projects & environments

Group services by project, then keep separate values for Development, Staging, and Production.

Secrets & history

Create or edit encrypted values. Open a secret's history to see its past version numbers and change dates.

People & access

Invite teammates and assign project roles. Owners and admins can manage members and required keys.

Audit & consistency

Review activity and see which environments are missing keys required by a project.

Use Settings → Required keys in a project for keys every environment must define. Compare shows missing keys in a matrix. Select a secret to open its inspector: hold Space to reveal, or Ctrl/Cmd + Space in Production. Touch users can press and hold the reveal control.

Everyday workflows

Search and rotation

Use Search in the sidebar to find variable names across projects you can access. Select a result to open that secret. Set a rotation date and optional repeat interval in its inspector; Rotations lists reminders. Updating a value reschedules recurring reminders. Reminders are in-app, with no email delivery.

Import and export

In Secrets, select an environment and choose Import .env. Paste text, preview the key names marked Create or Update, then confirm the import. Other keys and existing metadata are preserved. Export .env requires confirmation and downloads plaintext. Keep downloaded files private.

Compare fingerprints

Compare shows missing keys and whether values match a baseline, preferring Development. A fingerprint is a short identifier that helps you compare values without revealing them. Matching fingerprints mean the same key has the same value within this project. Different values may be intentional.

Copy a secret between environments

Open a secret and choose Promote, then select the destination environment. Review the destination and confirm. This copies the current value to that environment; the source stays unchanged. You can also drag a secret onto another environment to start the same review.

Production safeguards

Production writes require explicit confirmation. Project owners/admins can enable independent approval in Settings. Pending changes appear in Activity and do not alter active values until a different owner/admin approves. The review shows current and proposed fingerprints. Requests expire after seven days; stale values, stale metadata, removed permissions, or revoked tokens block approval. Requesters can cancel; admins can reject.

Vercel integration

Project owners/admins can connect Vercel in Project Settings using a project ID or slug, an optional team ID, and an access token. The token is encrypted on Shroud's server. Choose the source environment and destination target, preview the keys, then confirm the sync. Production sources or destinations need extra confirmation. Only approved values are sent; unrelated Vercel keys stay intact. Redeploy afterward to use the new configuration. Provider errors may leave partial external updates.

See Vercel's Secret environment variable documentation for destination behavior.

Collaboration

Workspaces & invitations

A workspace groups your team and projects. A project groups the variables for one app or service. Each environment keeps its own values, so Development and Production can use different configuration.

Invite a teammate

Open Team in the sidebar. Workspace owners and admins can choose Create invitation link.
Choose the teammate's role and the invitation expiry, then create the invitation.
Copy the generated link or token and share it with your teammate. Creating a link does not send an email automatically.
Your teammate can open the link or use Join workspace from the workspace menu and paste the link or token. Joining keeps their other workspace memberships.

Give access to a project

Joining a workspace does not automatically grant access to every project's secrets. A project owner or admin can open the project's Access tab and add a workspace member with the right project role. Viewers can read values; developers can add and update them; owners and admins manage project access and settings.

Switch workspaces

Use the workspace menu at the top of the sidebar. Your projects, terminal context, and available actions follow the selected workspace. If a project appears to be missing, check which workspace is selected.

Command line

Browser terminal & commands

Use Shroud commands directly in the website. The browser terminal shares your signed-in account and project access.

Use the browser terminal

Open Dashboard → Terminal. Your website session supplies authentication. No installation or API token is required.

Run shroud projects, then shroud use <project> to enter one. A new terminal starts without an active project.
Run shroud environments, then shroud env development. You can also enter a project and environment with the selectors.
Run shroud push KEY "value" to add or update one variable. Run shroud pull KEY to display its value.

browser terminal

shroud projects
shroud use my-api
shroud environments
shroud env development
shroud push API_KEY "your-value"
shroud pull API_KEY
shroud secrets --values

Command	In the website
help / shroud --help	Show available commands
shroud whoami / shroud teams	Show your account or teams
shroud projects	List accessible projects without entering one
shroud use <project>	Enter a project by ID, slug, or quoted name
shroud cd <project> / cd ..	Enter a project or leave the current one
shroud environments	List environments in your current project
shroud env <environment>	Enter an environment by ID, slug, or name
shroud secrets	List variable names
shroud secrets --values	Reveal all variables and their values
shroud pull <KEY>	Reveal the value of one variable
shroud push <KEY> "<VALUE>"	Add or update one variable directly
shroud push <KEY>=<VALUE>	Alternate syntax; KEY= saves an empty value
clear	Clear output and command history

The prompt shows your current project and environment. Listing projects does not enter one. Secret commands require both selections, and no project is selected automatically. Switching projects resets the environment.

Working with values

Push saves the variable name and value you type, with no file picker. Put values containing spaces in quotes. Values are literal: Shroud does not expand variables or execute shell syntax. Existing variables receive a new version; descriptions, required flags, and other variables stay unchanged.

Pull displays one variable as KEY="value". Use shroud secrets --values to see every value in the active environment. Push values are hidden in command output and excluded from Arrow Up/Down recall. Revealed values are kept only in the current page and disappear on context changes, Hide values, or clear.

Project viewers can read values. Developers, admins, and owners can add and update variables.

Production writes

Production writes open a confirmation dialog. If the project requires independent approval, the terminal reports a pending request instead of saving immediately. A different project owner/admin approves it in Activity. The optional desktop CLI uses --confirm-production on push.

Running local apps

The browser terminal manages Shroud variables. It cannot start programs on your computer or inject values into a local process. The optional desktop CLI supports .env file sync, shroud run, and CI workflows.

Optional desktop CLI and CI instructions

1. Install

Download the package and install it with npm.

2. Authenticate

Create a scoped API token in your workspace.

3. Sync & run

Pull a .env file, push updates, or inject variables into a process.

Install the CLI

Requires Node.js 22.12 or newer. The CLI is packaged with this app; it is not yet published to the npm registry.

Download CLI package

install from downloaded file

npm install -g ./shroud-cli-1.0.0.tgz
shroud --help

Set SHROUD_API_URL to the website address you use to open Shroud, so the desktop CLI connects to the same account and workspaces.

Create an API token

In the dashboard, open API tokens. Choose read access for pulling or running secrets. Add write access only if you will push values. Copy the new token when it appears; Shroud only shows it once.

authenticate

shroud login
shroud whoami
shroud teams

shroud login prompts for the token privately and stores it in ~/.shroud/config.json. For CI, set SHROUD_TOKEN instead of saving a local login.

Commands

Command	Purpose
login	Validate and save a token
whoami	Check current authentication
teams	List accessible teams
pull	Write environment values to a local .env file
push	Create or update secrets from a .env file
run	Run a command with Shroud values injected into its environment

Common workflows

Use a project ID or slug after -p, and an environment ID, slug, or type after -e. In an interactive terminal you can omit them and choose from a prompt.

local development

shroud pull -p my-api -e development -f .env.local
shroud run -p my-api -e development -- npm run dev

update staging

shroud push -p my-api -e staging -f .env.staging
shroud pull -p my-api -e staging -f .env.staging --force

pull asks before overwriting an existing file; --force skips that prompt. run does not write a file. Add any pulled .env file to your project's .gitignore.

CI and deployment

Set SHROUD_TOKEN and SHROUD_API_URL as protected environment variables in your CI system. Use a read-only token for pull and run. Revoke it from the dashboard when no longer needed.

CI example

SHROUD_API_URL=https://your-shroud.example SHROUD_TOKEN=shroud_... shroud run -p my-api -e production -- npm run build

Manage API tokens

Security

Access & security

Project membership controls which secrets and environments a signed-in person can see.
API tokens have separate read and write scopes. Create the narrowest token for each job and set an expiry.
Shroud shows a newly created API token only once. Treat it like a password and revoke it if exposed.
Do not commit pulled .env files or paste secret values into issues or chat.

Help

Troubleshooting

Terminal cannot load projects

Push is rejected

Enter a project and environment first. Your project role must be developer, admin, or owner to add or update a variable.

A Production update has not appeared

Check the project's Activity tab. If approval is required, your update stays pending until a different project owner or admin approves it. If the request expired or the secret changed, submit the update again.

Token is rejected

For the optional desktop CLI, run shroud whoami, then check whether your token expired or was revoked. Ask a workspace owner or admin for a new token if needed. A push also needs secrets:write. The browser terminal uses your website login and does not need an API token.

Email sign-up asks for confirmation

Open the confirmation link in your inbox, then return to Shroud to sign in. Check your spam folder if the message has not arrived.

Build with confidence.Keep secrets in sync.