OneGuard
ENAR

First steps

This walks through the shape of the whole product: a vault holds secrets, a secret holds your environment variables, and a directory on your machine is linked to one of them.

Everything below assumes you have installed the CLI and signed in with a write key.

1. Create a vault

A vault is the container your secrets live in — usually one per project or per team.

oneguard vault add --name "My API"

Vault created successfully with ID: 429110bc-d560-4f2d-9e03-9f35c7c1bd32

List them at any time:

oneguard vault list

Your vaults:

ID: 429110bc | Name: My API

2. Put your variables in a secret

If you already have a .env file, upload it as-is:

oneguard secrets add --project 429110bc --name "production" --file .env

The file is encrypted on your machine before it is sent. Otherwise, start with a single pair:

oneguard secrets add --project 429110bc --name "production" \
  --key DATABASE_URL --value postgres://localhost/app

3. Link a directory and sync

In your project folder:

oneguard env sync

The first run asks which vault and which secret, and remembers the answer in a .oneguard file next to your .env. Every run after that is instant:

Successfully synced environment variables into .env

That is the command you will use daily. A teammate who clones the repo runs the same oneguard env sync and gets the current values.

4. Generate a real password

Rather than inventing one, have OneGuard generate it and store it without ever printing it:

oneguard secrets generate --project 429110bc --id <secret> --key DB_PASSWORD --length 32

Added "DB_PASSWORD" in secret "production" (4 variables total).

Then pull it into your file:

oneguard env sync

5. Bring in your team

oneguard teams invite --email dev@example.com --role member

They accept the emailed invitation, install the CLI, and run oneguard env sync in the project — no secrets sent over chat.

Where to go next