Join and manage devices

Pair a new deviceCopy Anchor Link

On a device already in the vault, run:

envden device add

Enter your master password. envden shows a single-use code such as 3-K7QF-2MXP, valid for 10 minutes. Keep this terminal open.

On the new device, run:

envden join https://envden.your-tailnet.ts.net

Use your server's address and enter the pairing code. On the existing device, confirm the new device's name. The new device verifies the server pin and inherits the approver's remaining unlock time.

If the join was interrupted after approval, use envden join <server> --resume to fetch the committed approval message.

Join with your recovery kitCopy Anchor Link

If another device isn't available, use your master password and kit:

envden join https://envden.your-tailnet.ts.net --recovery-kit /path/to/kit.json

Or use --recovery to enter the recovery secret key and vault ID yourself. Other devices report the recovery-kit join on their next command.

Approve checkouts on the new machineCopy Anchor Link

Every checkout needs approval on this machine, including worktrees. If a local env file differs from the vault, choose whether to keep yours, take the server version or merge.

If Windows can't create symlinks, envden asks for consent before using copies. See Placement.

Unlock a deviceCopy Anchor Link

envden unlock

Enter your master password. A successful unlock prints Unlocked.

The default unlock period is 30 days. To read or change the vault's period:

envden config unlock-period
envden config unlock-period 7d

The accepted values are 1d, 7d, 30d and never. Changing the period requires a fresh password login. The read command returns JSON with a period field in milliseconds, or null for never.

Expiry stops pushes and pulls until you unlock again. It relies on the server enforcing it; see Security.

Remove a deviceCopy Anchor Link

List devices, then pass the device name or ID to rm:

envden device ls
envden device rm old-laptop

The list includes the envden version each device last used. Removal asks for your password, reports the file and key names the device could read, and asks for confirmation. It starts a new encryption epoch for future writes. Success prints Device removed.

Rotate the exposed credentials at their providers. Removing a device cannot erase files or keys it already has. Use --new-kit to replace the recovery kit in the same removal.

Manage vault keys and recoveryCopy Anchor Link

envden vault rotate
envden vault kit replace
envden vault password change
envden vault password reset

rotate asks for your master password and starts a new epoch. It prints Epoch rotated; old files aren't re-encrypted.

Use kit replace if you've lost the kit but still know the password. It replaces the recovery key and prints a new kit. Keep the replacement and discard the old one.

password change needs the old password and the recovery secret key. If you've forgotten the password, password reset needs an existing device and the recovery secret key. Both keep the current kit valid. If you've lost both the password and kit, create a new vault from a device's local store.