porter env

Create, list, get, set, and unset environment group variables and secrets from the Porter CLI for project-wide configuration management

porter env contains commands for managing environment groups — project-wide sets of environment variables and secrets that can be shared across applications.

Prerequisites

• You’ve logged in to the Porter CLI after running porter auth login
• You’re connected to the correct project by running porter config set-project

---

porter env list

List environment groups for the current project.

Usage:

porter env list [flags]

Options:

Flag	Description
--json	Print environment groups as JSON instead of a table

When a cluster is set (via porter config set-cluster, the --cluster flag, or the PORTER_CLUSTER environment variable), the list is scoped to that cluster: environment groups whose sync targets include the cluster, plus any cluster-scoped environment groups. This matches what the dashboard shows on the cluster’s environment groups page. Without a cluster context, all environment groups in the project are listed.

The default table output shows each group’s name, current version, and last updated time, sorted alphabetically by name.

Table (default)

porter env list

porter env list --json

The --json output returns two arrays — environment_groups and cluster_scoped_environment_groups — sharing one object shape:

{
  "environment_groups": [
    {
      "id": "2a54d3ab-08e2-4922-9368-a7e45ad87d23",
      "name": "tessier-internal",
      "current_version": 9,
      "created_at": "2026-02-25T09:23:16.332254Z",
      "updated_at": "2026-06-30T04:23:25.23501Z",
      "sync_target_cluster_ids": [11]
    }
  ],
  "cluster_scoped_environment_groups": [
    {
      "id": "",
      "name": "billing-db",
      "current_version": 202,
      "created_at": "2025-10-27T16:00:48Z",
      "updated_at": "2025-10-27T16:00:48Z",
      "sync_target_cluster_ids": [11]
    }
  ]
}

---

porter env create

Create a new environment group.

Usage:

porter env create [flags]

Options:

Flag	Description
--name	Environment group name (prompted interactively if omitted)
--variables, -v	Variables to set as key=value pairs
--secrets, -s	Secrets to set as key=value pairs
--no-input	Disable interactive prompts

Interactive

porter env create

porter env create --name production-secrets

porter env create --name production-secrets \
  -v NODE_ENV=production,LOG_LEVEL=info \
  -s DB_PASSWORD=secret,API_KEY=sk-123

If an environment group with the same name already exists, the command will fail. Use porter env set to update an existing group.

---

porter env pull

Pull environment variables from an environment group to your local machine.

Usage:

porter env pull [-g] <env-group-name> [flags]

Options:

Flag	Short	Description
--app	-a	Target application
--group	-g	Target cluster environment group
--variables	-v	Output only variables (excludes secrets)
--secrets	-s	Output only secrets (excludes variables)
--merged		Include variables from all linked env groups (only valid with --app)

Print to stdout

porter env pull production-secrets

porter env pull production-secrets -f .env.local

porter env pull production-secrets -v

porter env pull production-secrets -s

porter env pull --app my-app --merged

By default, both variables and secrets are output together. Use -v or -s to filter. You cannot use both flags at the same time.

---

porter env set

Add or update variables and secrets in an environment group.

Usage:

porter env set <env-group-name> [flags]

Options:

Flag	Short	Description
--variables	-v	Variables to set as key=value pairs
--secrets	-s	Secrets to set as key=value pairs

Set Variables

porter env set production-secrets -v LOG_LEVEL=debug,FEATURE_FLAG=true

porter env set production-secrets -s API_KEY=sk-new-key

porter env set production-secrets \
  -v NODE_ENV=production,LOG_LEVEL=info \
  -s DATABASE_URL=postgres://...

Use -s/--secrets for sensitive values like API keys and passwords. Secrets are stored in your cloud provider’s secret manager and are not visible after creation.

When you update an environment group, all applications synced to it are automatically redeployed with the new values.

---

porter env unset

Remove variables or secrets from an environment group.

Usage:

porter env unset <env-group-name> [flags]

Options:

Flag	Short	Description
--variables	-v	Comma-separated list of variable names to remove
--secrets	-s	Comma-separated list of secret names to remove

Remove Variables

porter env unset production-secrets -v OLD_KEY,UNUSED_VAR

porter env unset production-secrets -s ROTATED_KEY,OLD_SECRET

porter env unset production-secrets -v VAR1 -s SECRET1

When you update an environment group, all applications synced to it are automatically redeployed with the new values.

---

Legacy Commands

The following flag-based syntax is supported for managing app-level and cluster-level environment variables. These are legacy commands — for environment groups, use the positional argument syntax above.

Legacy Flags

Flag	Short	Description
--app	-a	Target application
--group	-g	Target cluster environment group
--target	-x	Deployment target name
--skip-redeploys		Skip re-deploying apps linked to the cluster environment group

You must specify either --app or --group, but not both.

Pull from App

porter env pull --app my-app

porter env pull --group staging-config

porter env set --app my-app -v KEY1=value1,KEY2=value2

porter env set --group my-env-group -v KEY1=value1

porter env unset --app my-app -v KEY1,KEY2

porter env set --group my-env-group -v KEY=value --skip-redeploys

---

Related

• Environment Groups — Overview of environment groups
• porter.yaml Reference — envGroups field in porter.yaml
• porter app — Application management commands
• porter apply — Deploy with porter.yaml