Infisical

Infisical is an optional way to manage the root .env. Instead of each teammate hand-editing secrets and passing them around, a shared vault holds them and everyone pulls the same .env with one command.

You don't need it. Copy .env.example to .env, fill in the values, and the stack runs: the @packages/env/* modules validate whatever's there, no matter where it came from. Infisical only changes the source of those values: one shared source of truth instead of a file copied through chat.

How the repo wires it

A committed .infisical.json at the root records the workspaceId that links this checkout to an Infisical project. With it in place, infisical export writes the root .env (or a stage-specific .env.<stage>) that @packages/env/* reads and validates at runtime. Infisical is the source of secrets; the .env file is the local artifact they land in.

infisical export --env=dev --output-file=./.env

--env is one of dev, staging, or prod.

Set it up

Install the CLI, log in, and link this checkout to your project:

bun add -g @infisical/cli
infisical login          # opens the browser; add --plain --silent for CI
infisical init           # writes .infisical.json with your workspaceId

Then re-run infisical export whenever secrets change. See the Infisical CLI reference for machine identities, self-hosting, and the full flag list.

Next

• Environment Variables: the .env this fills, and how @packages/env validates it per-consumer.
• Quickstart: where the .env first comes into play.