Export and CI access
OneEnv exports configuration; your pipeline pulls it.
By the OneEnv team · Last updated
What it is
Each service has an Export tab. It resolves every inherited key to one value and renders it as shell, dotenv or HOCON, or through a custom template that can reference other values with ${config.KEY}-style placeholders. A saved custom template overrides the format choice.
Resolution rule
For each key: the service's published override if it has one, otherwise the last value that service approved. The shared master's current value is not used directly, which is why an unapproved change never leaks into a consumer's export.
DATABASE_HOST=db.internal.example
DATABASE_PORT=5432CI access
A service's Export tab has a CI / API tokens panel. Tokens are scoped to a service, shown once, stored as a hash and revocable. A pipeline fetches the export from the token URL shown there, without a user login. Treat a token like a secret: it returns real values including secrets.
Leaving OneEnv
Exports are plain text. An Owner or Admin can also download a workspace takeout (JSON, or an Excel workbook with one sheet per domain) from workspace Settings.
Limitations
- Export is pull-based. OneEnv never pushes to your runtime.
- No secret rotation or short-lived credentials.