CLI Workflow

Commands

Command	Description
`vars init`	Initialize vars in your project — creates config, key, gitignore, hook
`vars gen <file>`	Generate TypeScript types from a .vars file. `--platform node \| serverless \| deno \| static` selects the output shape. `cloudflare` was removed in the current major — use `serverless` instead.
`vars show [file]`	Decrypt a .vars file in-place for editing
`vars hide`	Encrypt all unlocked .vars files
`vars run --env <env> -- cmd`	Run a command with decrypted env vars injected
`vars check [-f file]`	Validate schemas and run check blocks
`vars add <name>`	Interactively add a variable
`vars remove <name>`	Remove a variable from a .vars file
`vars ls`	List all .vars files with lock state and var count
`vars ls <file>`	List variables in a file with metadata
`vars export --env <env>`	Export as dotenv, json, or k8s-secret format
`vars key init`	Create a new encryption key
`vars key rotate`	Rotate the encryption key
`vars key fingerprint`	Print the key fingerprint
`vars key export`	Print base64 master key for CI
`vars doctor`	Diagnose your vars setup

Variable	Description
`VARS_KEY`	Base64-encoded master key — bypasses PIN prompt. Required for CI/CD. Get it with `vars key export`.