Manage Python environment variables without .env files

Python apps usually read secrets with os.environ, often loaded from a .env file by python-dotenv. dotsafe keeps the variables encrypted on your Mac and sets them when your process starts, so os.environ["DATABASE_URL"] keeps working.

Move your .env into dotsafe

dotsafe import                                 # ./.env into the development environmentrm .env

load_dotenv() doesn't override variables that are already set, so you can leave it in place while you switch.

Run your app

dotsafe run -- python manage.py runserver      # Djangodotsafe run -- flask run                       # Flaskdotsafe run -- uvicorn app.main:app --reload   # FastAPIdotsafe run -- pytest                          # tests get the same variables

With uv or Poetry, put dotsafe run -- in front: dotsafe run -- uv run pytest.

Production settings

dotsafe set -e production DJANGO_SECRET_KEY    # asks for the valuedotsafe run -e production -- python manage.py migrate

Generate random secrets without ever seeing them:

dotsafe secret rotate DJANGO_SECRET_KEY --generate

Notebooks and scripts

dotsafe run -- jupyter lab gives every notebook kernel your variables, without a key pasted into a cell.

Start with the quick start.