Env Sources — Secrets That Stay on Your Mac

Every project needs secrets — API keys, database URLs, tokens. You should never commit them, and you may not want them sitting in the cloud at all. Env Sources is how RepoGo gives your services their secrets without either: the secrets stay on your Mac, and a service borrows them — in memory only — for as long as it runs.

The idea splits cleanly in two:

• Your repo says what it needs — a service in environment.json lists named sources with envFrom: ["my-secrets"]. Just names. Nothing sensitive ever goes in the repo.
• You say where each name lives — once, in the app, you point my-secrets at a Mac and a .env file on it.

That mapping is private to you and never leaves your Mac. The repo only ever contains the name.

The mental model#

An env source is a named pointer: a handle (like api-secrets) bound to one .env file on one of your Macs. It says "when something asks for api-secrets, read this file off this Mac." The secret itself is never copied into RepoGo — the binding is just an address.

A repo's environment.json references the handle and nothing else:

{ "name": "api", "cmd": "bun install && bun start", "envFrom": ["api-secrets"] }

Setting one up#

Open Env Sources in the app (left drawer → profile icon → Env Sources). Tap Add Source and walk three steps:

1. Pick the Mac. Choose which of your paired Macs the file lives on. If you only have one, it's chosen for you. RepoGo always reads from the Mac you pick — it never guesses or searches your other Macs.
2. Browse for the file. Navigate your Mac's folders right in the app and pick the .env file (or any dotenv-style file you keep secrets in).
3. Name the handle. Give the source a short name — this is the string your repo uses in envFrom. Handles are slugs: lowercase letters, numbers, and dashes (api-secrets, stripe, web-env). RepoGo suggests one from the filename; keep it or edit it.

Save, and the source shows up in your list. That's the whole setup — you never do it again unless the file moves.

To remove a source, swipe it away in the list. Deleting a source only drops the pointer; the file on your Mac is untouched. Any service still referencing that handle simply starts without those variables (see below).

What happens when a service starts#

When a service with envFrom boots — on a fresh environment, or every time it wakes — RepoGo:

1. Looks up the handle in your Env Sources to find the Mac and path.
2. Asks that Mac to read the file, and your iPhone authorizes the read. (If your phone is asleep, you get a notification to approve.)
3. Loads the variables into the service in memory and starts it.

Your secrets are never written to the environment's disk and never captured in a snapshot. They're fetched fresh from your Mac each time the service starts. When the environment sleeps, they're gone; on the next wake, they're fetched again.

If you decline, or your Mac is unreachable, the service still starts — just without those variables. A service that genuinely needs them will print the error in its terminal tab, where you can see it, fix it, and restart.

Great for teams#

Because the repo holds only the name of a source, a teammate who clones the same project just points that name at their own file on their own Mac — once, in the app. No shared secrets, no per-person edits to environment.json, nothing to coordinate. The same committed config works for everyone, each person resolving the handle to their own credentials.

Multiple Macs#

You choose which Mac each source reads from when you create it, so different sources can come from different machines — api-secrets from your MacBook, stripe from your Mac Studio. RepoGo always reads from the Mac bound to that source. The Mac has to be reachable when the service starts; if it isn't, the read is skipped and the service starts without those variables.

How it fits with environment.json#

Env Sources is the secrets half of Start Services Automatically. The two meet at one field:

• In environment.json, envFrom: ["name", ...] lists the sources a service needs.
• In the app, Env Sources binds each name to a Mac and a file.

Everything else about a service — cmd, target, expose, dependsOn — is described in the startup-services doc. Env Sources only governs where the secrets come from.

Frequently asked questions#

Where do my secrets get stored? Only on your Mac, in whatever .env file you already keep them in. RepoGo stores a pointer to that file (the Mac + path), not the contents. The secrets are loaded into a running service in memory and never written to the cloud or a snapshot.

Do I commit anything for this? Only the handle. In environment.json you write envFrom: ["api-secrets"] — a name. The Mac, the path, and the secret never touch the repo.

What if I decline the read, or my Mac is off? The service still starts, just without those variables. If it can't run without them, it'll say so in its terminal tab; reconnect your Mac (or approve the read) and restart it.

A teammate cloned the repo — do they get my secrets? No. The repo only holds the source name. Each person points that name at their own file on their own Mac, once. Your secrets never leave your Mac.

Can different sources come from different Macs? Yes. You pick the Mac per source when you create it.

What happens to the secrets when the environment sleeps? They're gone — nothing secret is persisted. They're fetched fresh from your Mac the next time a service that needs them starts.

Next steps#

• Set up the services that consume these secrets: Start Services Automatically with environment.json.
• New to cloud machines? Start with Cloud Sandboxes on Vercel.