using-sops

Using sops Repositories that use this layout commit their secrets to git as sops-encrypted dotenv files, one per deployment environment: secrets/dev.env , secrets/prod.env . The files decrypt with age identities. There is no .env , no secrets service, and no session to log in to. Every checkout, worktree, and cloud sandbox has the encrypted files at clone; the only input anywhere is an age private key. pnpm secrets ( tools/secrets.ts ) is the only interface. Do not call sops directly in a repo that has the wrapper. Identities Identity Scope Where the private key lives Decrypts agent user-wide ~/.config/sops/age/keys.txt on every machine agents run on; SOPS_AGE_KEY in cloud sandboxes dev.env personal user-wide the user's password manager every file prod per project that project's production platform only prod.env Show more Installs 1.1K Repository jssblck/agents First Seen Aug 15, 2026 Security Audits Gen Agent Trust Hub Pass Socket Pass Snyk Pass