envpact (Python)

Zero-dependency Python module for envpact — a centralized, serverless, Git-backed secrets manager for solo developers.

Read & write the same vault that envpact-cli, envpact-mcp, and envpact-vscode use. Identical semantics, native Python API.

Part of the envpact ecosystem.

Installation

pip install envpact

Python 3.10+. No runtime dependencies — just stdlib.

Quick Start

If you don't have a vault yet, bootstrap it once with the Node CLI:

npx envpact-cli --init auto

Then use Python directly:

from envpact import EnvPact

pact = EnvPact()
pact.generate_env()                 # writes .env for the current project
pact.add_shared("OPENAI_API_KEY", "sk-…")
pact.rotate("OPENAI_API_KEY", "sk-new")
pact.sync_github(project_name="my-app")

CLI

The package also ships a thin CLI mirroring envpact-cli:

python -m envpact          # generate .env
python -m envpact --list   # list projects
python -m envpact --rotate OPENAI_API_KEY

After installation, the envpact script is also on your $PATH.

API

EnvPact(...)

EnvPact(
    *,
    vault_file: Path | str | None = None,
    secrets_dir: Path | str | None = None,
    project_name: str | None = None,
    environment: str | None = None,
    auto_pull: bool = True,
    auto_push: bool = True,
)

Methods

Resolver helpers

from envpact import resolve_project, resolve_string, list_project_environments

# Pure functions over a parsed vault dict — useful for tests.
result = resolve_project(vault_dict, "my-app", "production")

Vault Schema

Identical to envpact-cli — see SHARED_SPEC §1.

Security

• Vault values are read directly from the user's local clone at ~/.envpact/secrets/. Nothing is ever sent to a third party.
• list_shared() returns names only.
• .env files are written with mode 0600 where the OS supports it.
• All vault commits are signed-off (-s).

License

MIT © Chirag Singhal — see LICENSE.