Web app guide

The web app is where you read, edit and share environments, manage who has access, and review what changed. It works on desktop and phone, in light and dark themes.

Sign up and workspaces#

Create an account with your name, email and a password of at least 10 characters. Every account starts with a personal workspace (an organisation) that you own. Organisation owners and admins can see every project in the organisation; everyone else sees only the projects they were invited to. Use the theme switch in the sidebar, or Account > Appearance, to choose light, dark or your device setting.

Projects and environments#

A project is one app or service. Its environments (by default development, staging and production) are the tabs across the top of the project. Each environment has its own variables and its own linear history of versions. Add, rename, delete or copy environments under Settings.

Variables#

The Variables tab lists the names in the current version, with each value hidden. Under the title, a line tells you the current version, who saved it and what changed.

• Reveal: show one value with the eye icon, or all with Reveal values. Revealing is recorded in the audit log; just viewing names is not.
• Copy and download: copy a single value, or download the whole environment as a .env file.
• Edit: Edit variables opens an editable table. Add, change or remove rows, or Paste .env to import a whole file (merge, or replace everything). Invalid names are blocked.
• Review and save: before anything is saved you see exactly what is added (+), changed (~) and removed, and can add a message. Saving creates a new version; saving identical content creates nothing.
• Last changed: each variable shows the version, person and time of its most recent change.

History and rollback#

The History tab lists every version with its message, author, time and signed change counts (added, changed, removed). Click the counts to see which key names changed.

• Compare two versions to see changed keys; values stay hidden until you choose Reveal values.
• View the full contents of an older version.
• Roll back saves an older version as a new one. Nothing is deleted or rewritten, so you can always roll forward again.

Members and access#

Open Members to see who can access the project. Each person has a role and a scope:

The scope is either all environments or only selected environments, where you give each one no access, read, or read and write. A viewer is always read-only, even with a write grant. An environment a person has no access to is invisible to them.

Invitations#

Choose Invite someone, enter their email, set the role and the environments, and pick an expiry from 1 to 30 days. If the server has SMTP configured, the dialog shows Email the invitation to this address, on by default, and the server sends the link for you. Without SMTP, or if you untick it, you get a link to send them yourself. If the email cannot be sent, the invitation is still created and the dialog tells you, so you can share the link by hand. The link works once, only for that email address, and only until it expires.

Pending invitations appear below the member list. When email is configured, Resend email sends the invitation again with a fresh link and retires the old one, which is useful if the first message got lost. If one expires unused it is marked expired; use Reopen (or Extend for one still open) to give it a new deadline counted from now. The same link works again. People can also accept from Invitations in the sidebar when they are signed in with the invited email. Invitees must already have an account, so if you have closed registration, create theirs first.

Tokens#

Under Tokens (project admins) create service tokens for CI: limited to this project, optionally to one environment, read-only or read and write, with an expiry. The token is shown once. Personal tokens, used by the CLI, live under Account. Revoke any token at any time.

Audit log#

Admins can open Audit log to see who read values, saved versions, rolled back, invited people, created tokens or signed in, with time and IP address. Secret values are never recorded. Organisation owners and admins also see recent activity across all projects on the Organisation page.

Project settings#

Rename the project, manage environments (add one, optionally copied from an existing environment, rename or delete), and delete the project. Deleting a project asks you to type its name and removes its environments, versions and tokens permanently.

Your account#

Account holds your appearance setting, two-step verification, personal access tokens, and the commands to set up the CLI.

Two-step verification#

Under Account > Two-step verification choose Set up. Confirm your password, scan the QR code with an authenticator app (or type the key by hand), and enter the six-digit code it shows. You then get ten single-use recovery codes, shown once: save them somewhere safe. Turning it on signs out your other sessions.

Backups if you lose your phone#

• Recovery codes: each works once. Generate a new set at any time (this replaces the old ones).
• Email codes: if the server has email configured, a one-time code can be sent to your address at sign-in. You can switch this off if you want authenticator-only sign-in.

Turning two-step verification off, generating recovery codes and changing the email setting all ask for your password and a current code. Scripts that use personal or service tokens do not need a second step, so keep those tokens scoped and short-lived.

Prefer the terminal? See the CLI guide. Running the server yourself? See self-hosting.