@dotenvx/dotenvx 1.70.0 → 1.71.0

package/CHANGELOG.md

@@ -2,7 +2,13 @@
 
 All notable changes to this project will be documented in this file. See [standard-version](https://github.com/conventional-changelog/standard-version) for commit guidelines.
 
-[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.70.0...main)
+[Unreleased](https://github.com/dotenvx/dotenvx/compare/v1.71.0...main)
+
+## [1.71.0](https://github.com/dotenvx/dotenvx/compare/v1.70.0...v1.71.0) (2026-06-01)
+
+### Added
+
+* Add optional automation `--token` support for Armor ⛨ users ([#831](https://github.com/dotenvx/dotenvx/pull/831))
 
 ## [1.70.0](https://github.com/dotenvx/dotenvx/compare/v1.69.2...v1.70.0) (2026-05-31)
 

package/README.md

@@ -1286,6 +1286,15 @@ $ dotenvx set HELLO Dotenvx -fk .env.keys -f apps/app1/.env
 $ dotenvx run -fk .env.keys -f apps/app1/.env -- yourcommand
 ```
 
+</details>
+<details><summary>`run --token`</summary><br>
+
+Set Armor ⛨ token for retrieving armored private keys.
+
+```sh
+$ dotenvx run --token "$DOTENVX_ARMOR_TOKEN" -- yourcommand
+```
+
 </details>
 <details><summary>`run --no-armor`</summary><br>
 

package/package.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.70.0",
+  "version": "1.71.0",
   "name": "@dotenvx/dotenvx",
   "description": "a secure dotenv–from the creator of `dotenv`",
   "author": "@motdotla",

package/src/cli/actions/run.js

@@ -22,7 +22,7 @@ async function run () {
   const ignore = options.ignore || []
 
   const sesh = new Session()
-  const noArmor = options.armor === false || (await sesh.noArmor())
+  const noArmor = options.armor === false || (!options.token && (await sesh.noArmor()))
 
   if (commandArgs.length < 1) {
     if (spinner) spinner.stop()
@@ -55,6 +55,7 @@ async function run () {
       readableFilepaths,
       uniqueInjectedKeys
     } = await new Run(envs, options.overload, process.env, options.envKeysFile, noArmor, {
+      token: options.token,
       keypairHooks: {
         after: () => {
           if (spinner) spinner.start('injecting')

package/src/cli/dotenvx.js

@@ -70,6 +70,7 @@ program.command('run')
   .option('--strict', 'process.exit(1) on any errors', false)
   .option('--convention <name>', 'load a .env convention (available conventions: [\'nextjs\', \'flow\'])')
   .option('--ignore <errorCodes...>', 'error code(s) to ignore (example: --ignore=MISSING_ENV_FILE)')
+  .option('--token <token>', 'set Armor ⛨ token')
   .option('--no-armor', 'disable dotenvx-armor features')
   .addOption(new Option('--no-vlt', 'disable dotenvx-vlt features (deprecated. use --no-armor)').hideHelp())
   .addOption(new Option('--no-ops', 'disable dotenvx-ops features (deprecated. use --no-armor)').hideHelp())

package/src/lib/helpers/keyResolution/keyValues.js

@@ -73,7 +73,11 @@ async function keyValues (filepath, opts = {}) {
 
   // armor
   if (!noArmor && !privateKey && publicKey && publicKey.length > 0) {
-    const kp = await armorKeypair(publicKey, { envFilepath: filepath, hooks: opts.keypairHooks })
+    const armorOptions = { envFilepath: filepath, hooks: opts.keypairHooks }
+    if (opts.token) {
+      armorOptions.token = opts.token
+    }
+    const kp = await armorKeypair(publicKey, armorOptions)
     privateKey = kp.privateKey
     privateKeySource = 'armor'
   }

package/src/lib/helpers/keyResolution/keyValuesFromEnvSrc.js

@@ -53,7 +53,11 @@ function keyValuesFromEnvSrc (src, privateKeyName = null, opts = {}) {
   }
 
   if (!noArmor && !privateKeyValue && publicKeyValue && publicKeyValue.length > 0) {
-    const kp = armorKeypairSync(publicKeyValue)
+    const armorOptions = {}
+    if (opts.token) {
+      armorOptions.token = opts.token
+    }
+    const kp = armorKeypairSync(publicKeyValue, armorOptions)
     privateKeyValue = kp.privateKey
     privateKeySource = 'armor'
   }

package/src/lib/helpers/keyResolution/keyValuesSync.js

@@ -74,6 +74,9 @@ function keyValuesSync (filepath, opts = {}) {
   // armor
   if (!noArmor && !privateKey && publicKey && publicKey.length > 0) {
     const armorOptions = { envFilepath: filepath }
+    if (opts.token) {
+      armorOptions.token = opts.token
+    }
     if (opts.noSpinner) {
       armorOptions.noSpinner = true
     }

package/src/lib/main.d.ts

@@ -154,6 +154,13 @@ export interface DotenvConfigOptions {
    */
   noSpinner?: boolean;
 
+  /**
+   * Set Armor token.
+   *
+   * @example require('@dotenvx/dotenvx').config({ token: process.env.DOTENVX_ARMOR_TOKEN })
+   */
+  token?: string;
+
   logLevel?:
     | 'error'
     | 'warn'

package/src/lib/main.js

@@ -60,7 +60,8 @@ const config = function (options = {}) {
       readableFilepaths,
       uniqueInjectedKeys
     } = new Run(envs, overload, processEnv, envKeysFile, noArmor, {
-      noSpinner: options.noSpinner
+      noSpinner: options.noSpinner,
+      token: options.token
     }).runSync()
 
     let lastError
@@ -324,7 +325,7 @@ const keypair = function (envFile, key, envKeysFile = null, noArmor = false) {
 
 function resolveNoArmor (options = {}) {
   const sesh = new Session()
-  return options.noArmor === true || options.noVlt === true || options.noOps === true || sesh.noArmorSync()
+  return options.noArmor === true || options.noVlt === true || options.noOps === true || (!options.token && sesh.noArmorSync())
 }
 
 module.exports = {

package/src/lib/services/run.js

@@ -24,6 +24,7 @@ class Run {
     this.envKeysFilepath = envKeysFilepath
     this.noArmor = noArmor
     this.noSpinner = options.noSpinner
+    this.token = options.token
     this.keypairHooks = options.keypairHooks
 
     this.processedEnvs = []
@@ -95,7 +96,7 @@ class Run {
         privateKeyName: resolvedPrivateKeyName,
         privateKeyValue,
         privateKeySource
-      } = keyValuesFromEnvSrc(env, privateKeyName, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor, processEnv: this.processEnv })
+      } = keyValuesFromEnvSrc(env, privateKeyName, { keysFilepath: this.envKeysFilepath, noArmor: this.noArmor, processEnv: this.processEnv, token: this.token })
 
       const {
         parsed,
@@ -144,7 +145,8 @@ class Run {
       const { privateKeyValue, privateKeySource } = keyValuesSync(filepath, {
         keysFilepath: this.envKeysFilepath,
         noArmor: this.noArmor,
-        noSpinner: this.noSpinner
+        noSpinner: this.noSpinner,
+        token: this.token
       })
 
       const {
@@ -197,6 +199,7 @@ class Run {
       const { privateKeyValue, privateKeySource } = await keyValues(filepath, {
         keysFilepath: this.envKeysFilepath,
         noArmor: this.noArmor,
+        token: this.token,
         keypairHooks: this.keypairHooks
       })