Use case
Your .env and secrets sync to trusted machines
Stop hiding .env setup in private notes and scripts. Bowline syncs .env files and secrets end-to-end with the project.
Who this is for
Search intent: sync .env files between machines.
The code is easy to move; the environment is what breaks. You clone cleanly on a new box and then nothing runs, because .env, .env.local, and a dozen keys live only on your old machine. So you scp them around, paste keys into chats, or keep a private gist you hope is current.
Before and after
The status quo, and what changes once bowline is keeping this workspace in sync.
Today
- You scp .env files between machines or paste keys into a notes app to move them.
- A fresh clone runs and immediately fails on a missing DATABASE_URL, STRIPE_SECRET, and half your integrations.
- Secrets sprawl across machines with no record of which copy is current.
- An agent host or CI box needs the same keys, so you re-enter them by hand every time.
With bowline
- Env files and secrets travel end-to-end with the project to trusted devices and agent hosts.
- Open the project on a second machine or an agent host and the environment is already there.
- No bowline shell, no manual key copy, no wrapper around your process.
- The hosted service carries ciphertext and cannot read secret values, and device trust is revocable.
The setup
Install once, approve the device, and open the folder. No manifests and no keys to copy between machines.
curl -fsSL https://install.bowline.sh | shInstall on the new box, then bowline setup --root ~/Code.
bowline connect laptop-2Approve the device once; encrypted env and secrets come with the tree.
cd ~/Code/acme/web && pnpm devRun immediately, with no hidden key-copy step.
What makes it work
The bowline capabilities that carry this workflow.
Env files and secrets travel end-to-end with the project to trusted devices and agent hosts.
No shell wrapper: your existing tools keep reading local env files directly.
Revocable per-device trust means a lost laptop can be cut off from workspace access.
Recovery keys you hold let you regain access without trusting the relay with plaintext.
Common questions
Short answers to the questions this setup raises first.
Are my secrets readable by Bowline's servers?
No. Secret values sync end-to-end to trusted devices and agent hosts; Bowline's hosted service carries ciphertext and cannot read them. The security-critical code for device trust and recovery keys is open source under Apache 2.0.
Do I have to run my app inside a special shell to load the env?
No. There is no bowline shell to enter. Your existing tools keep reading local env files exactly as they do today.
What happens to the secrets if I lose a device?
Revoke that device's trust and it can no longer access your workspace. You hold recovery keys, so you keep access from your remaining machines.
Does this cover per-environment files like .env.local and .env.production?
Yes. .env, .env.local, and .env.* sync end-to-end with the project to trusted devices and agent hosts.
Your ~/Code, on every machine and every agent.
Install bowline and your projects follow you. It just works.
curl -fsSL https://install.bowline.sh | shmacOS app · Linux CLI. Then run bowline setup --root ~/Code.