Integrations

Every platform your keys have to reach.

Sync environment variables to GitHub Actions, Vercel and Coolify from the desktop app, and read AWS Secrets Manager and Vault next to your files. Keep the value in your repo, read the receipt, approve the plan, and it lands where you deploy.

Request accessCompare platform support
  • 9 integrations
  • 1 approval per sync
  • 0 values shown, ever
Deploy platforms

Set a value once. Ship it to every platform you deploy to.

  • GitHub Actions

    Available

    Sync to repository or environment secrets with a fine-grained token. GitHub never returns secret values, so read-back checks names: what exists shows before your workflow fails.

    • Repository secrets
    • Environment secrets
    • Names-only read-back (GitHub never returns values)
    • Organization secrets next

  • Vercel

    Available

    Keep project environment variables in step with your local .env.production, .env.preview and .env.development.

    • Project variables
    • Production / preview / development targets
    • Team projects
    • Existing variables updated only when targets match

  • Railway

    Coming soon

    Sync variables to any service in any environment, with the redeploy left to you.

    • Service variables
    • Environment targeting
    • Shared project variables
    • No automatic redeploy

  • Render

    Coming soon

    Manage environment groups and per-service variables from the same receipt view.

    • Environment groups
    • Service variables
    • Blueprint-friendly
    • Multi-service plans

  • Dokploy

    Coming soon

    Point at your own Dokploy instance, custom CA and all, and sync application variables.

    • Application variables
    • Custom endpoint
    • CA certificate support
    • Compose projects

  • Coolify

    Available · self-hosted

    Sync variables to Coolify applications and services on your own server, including preview deployments.

    • Application and service variables
    • Self-hosted endpoint (https, or an ssh tunnel)
    • Values read back with read:sensitive
    • Preview deployments
Secret stores

Treat a secret store like another environment.

  • AWS Secrets Manager

    Read-only source

    Treat a secret as an environment: read it through the aws CLI and your own profile, compare it, copy from it into a file. Nothing is ever written to AWS.

    • Your AWS credentials, your machine, nothing stored
    • JSON secret → .env mapping
    • One secret, or every secret under a prefix, per region
    • Read-only by construction: no write path exists

  • HashiCorp Vault KV v2

    Source & target

    Read a KV v2 path with your token, compare it as a redacted shape, and sync through the same approval step.

    • KV v2 paths
    • Namespaces
    • Self-hosted or HCP
    • Check-and-set guarded writes
AI coding agents

Give agents the mismatch, never the values.

  • MCP · coding agents

    AI agents

    A local MCP server for Claude Code, Cursor and friends: mismatch context and dry-run plans, never values, never a sync.

    • Key names + mismatch classes
    • Dry-run plans
    • No values, ever
    • Cannot execute a sync
Support matrix

Compare platform support

What each connection can do today. ✓ supported · ◐ partial · × not applicable.

FeatureGitHub ActionsVercelRailwayRenderDokployCoolifyAWS Secrets ManagerHashiCorp Vault KV v2MCP · coding agents
Human-approved sync✓✓✓✓✓✓×✓×
Environment targeting✓✓✓✓◐◐✓✓✓
Org / team scope✓✓✓✓×××✓×
Self-hosted endpoint××××✓✓×✓✓
Preview environments×✓×××✓×××
Read back for drift◐✓✓✓✓✓✓✓✓
Why teams centralise in the repo, not the cloud

Stop environment drift without moving your secrets.

Single source of truth

The .env in your repo stays the source. Platforms are targets you sync to, not places you edit.

Drift you can see

Read-back means a receipt shows what a platform actually has before you deploy, not after it fails.

Approval-first

Every write is a plan you read and approve. Nothing is one-click, nothing is scheduled.

FAQ

Frequently asked questions

Which platforms are supported?

GitHub Actions, Vercel and Coolify as deploy targets today, with Railway, Render and Dokploy next. HashiCorp Vault KV v2 is a secret store you can read from and write to. AWS Secrets Manager is a read-only source: Drift scans and compares it, and never writes to it. Plus a local MCP server for coding agents. Ask for the one you are missing when you request access.

How does a sync work?

You connect a platform with your own credentials, which stay on your machine. Drift reads what the platform currently has, shows a redacted receipt against your local file, builds a dry-run plan, and writes only after you approve that exact plan in the app.

Can I target multiple environments?

Yes. Local .env.production, .env.preview and .env.staging map to the matching platform environment, so a receipt always compares like with like.

Is anything automatic or scheduled?

No. There is no scheduler and no unattended write path. Every sync is one you read and approve.

Does it work with self-hosted platforms?

Yes. Coolify accepts your own endpoint over https, or plain http through an ssh tunnel. Vault can be self-hosted or HCP, with a custom CA. Dokploy joins them when it lands.

Connect your first platform.

Tell us where you deploy and we will set you up on the desktop app.

Request access