# Sink > Sink is a hosted secret manager for development teams. Every secret is stored under AES-256-GCM envelope encryption, organised as Workspaces → Teams → Projects → Environments, and synced to a local `.env` file with a CLI (`sink pull`, `sink push`, `sink diff`). Hosted at https://usesink.co, currently in public beta. How it fits together: - **Encryption.** Each secret gets its own AES-256-GCM data encryption key (DEK); the DEK is itself encrypted under the deployment's master key before it is written. Neither the plaintext value nor the raw DEK is stored. One compromised ciphertext is one secret rather than the whole table. - **Hierarchy.** A workspace holds teams, a team holds projects, a project holds environments, an environment holds secrets. Environments are isolated from each other, so development never sees production's values. - **Access.** Four roles — Viewer, Member, Admin, Owner. Every create, read, update, delete and share is written to an audit log with the member and timestamp. Secrets are versioned: each update mints a new version for that key, and old versions stay readable. - **Auth.** Email/password, Google OAuth SSO, GitHub OAuth SSO for people; `sk-`-prefixed API keys with configurable expiry for programmatic and CLI access. - **Getting values in and out.** Import straight from Railway, Vercel, Render, Doppler, Infisical, AWS Secrets Manager or Azure Key Vault, paste a `.env`, or share a single key or a whole environment through a link that expires and dies after a set number of views — no account needed by the recipient. - **Import credentials.** Used for that one request and discarded by default. A workspace admin can instead save one as a *connection*: the credential is then stored server-side, encrypted under the same envelope scheme as a secret, never returned by any endpoint, revocable from Settings, and deleted outright when the workspace or team is. Secret stores name things `myapp/prod/db-password`, which is not a variable name, so those imports rewrite keys (`DB_PASSWORD`) and split a flat-JSON secret into one variable per field — every rename is shown in the preview before anything is written. What Sink deliberately does not do: dynamic or short-lived secrets, scheduled rotation, a Kubernetes operator, a Terraform provider, or self-hosting. It stores values you give it and hands them back to the people and machines allowed to have them.Interactive OpenAPI documentation (`/docs`, `/redoc`, `/openapi.json`) is served only when the deployment runs with `DEBUG` enabled, so it is not available on the hosted production instance. ## Product - [Sink home](https://usesink.co/): What Sink is, the security model, the pricing tiers (Free $0/mo, Starter $7/mo, Scale $35/mo) and an FAQ. - [Install the CLI](https://usesink.co/install): The one-line installer for the `sink` command line client. - [Sign up](https://usesink.co/auth/signup): Create an account with email and password, Google or GitHub. - [Log in](https://usesink.co/auth/login): Sign in to the dashboard, where workspaces, projects, environments, secrets, members and API keys are managed. ## Guides - [Guides index](https://usesink.co/guides): All guides on handling environment variables and secrets. - [How to share a .env file securely](https://usesink.co/guides/share-env-file-securely): Why Slack and email leave an unrevocable copy, the six properties a safe hand-off needs, and three methods — an expiring view-limited link, workspace access, or age/GPG — plus what to do about credentials already sent over chat. - [How to remove a .env file from git history](https://usesink.co/guides/remove-env-file-from-git): Rotate first, rewrite second. `git rm --cached` and amend for unpushed commits; `git filter-repo --path .env --invert-paths` or BFG on a mirror clone for pushed ones; and the copies a force-push does not reach (pull request diffs, forks, cached views, CI logs). - [How to sync environment variables with Vercel](https://usesink.co/guides/sync-env-vars-vercel): Why Production, Preview and Development drift apart, importing each target with `sink import vercel --project --provider-env`, and the pull/diff/push loop. - [How to sync environment variables with Railway](https://usesink.co/guides/sync-env-vars-railway): Importing a service-and-environment pair with `sink import railway --project --service --provider-env`, what happens to reference variables, and using `--prune` safely. - [How to sync environment variables with Render](https://usesink.co/guides/sync-env-vars-render): Importing a service's environment with `sink import render --service`, handling env groups, and the two options for Render secret files. - [Looking for a Doppler alternative](https://usesink.co/compare/doppler-alternative): The questions worth asking any hosted secret manager — encryption model, access scoping, what the audit trail records, the local workflow, data export, downtime behaviour — and a direct account of where Sink fits and where it does not. ## CLI - [install.sh](https://usesink.co/install.sh): Installer script, served by the deployment it installs a client for; the version always matches that server. `curl -fsSL https://usesink.co/install.sh | sh` - [Release manifest](https://usesink.co/cli/manifest.json): Current CLI version and the wheel's checksum, which the installer verifies before linking `sink` into `~/.local/bin`. Commands: `sink login` stores an API key in the OS keychain; `sink whoami` shows the active account, the linked project and the plan; `sink logout` forgets the key. `sink init` writes a `.sink.json` linking the directory to a workspace, team, project and environment (ids only, no values, safe to commit). `sink pull [env]` writes the environment to `./.env` with `0600` permissions — `--output/-o` for another path, `--format json`, `--stdout` to print instead, `--version/-V N` to read each secret at that version number. `sink diff [env]` shows how the local file differs, masked unless `--show-values`, and `--exit-code` makes any difference exit 1 for CI. `sink push [env]` sends local changes up, with `--dry-run` to preview and `--prune` to delete remote secrets absent locally. `sink import railway|vercel|render [env]` pulls variables out of a hosting provider, with `--token/-t` (or `-` for stdin, or `SINK__TOKEN`), `--project`, `--service`, `--provider-env`, `--mode skip|overwrite` and `--dry-run`. For CI, set `SINK_API_KEY` and `SINK_API_URL` instead of running `sink login`. ## Crawling - [robots.txt](https://usesink.co/robots.txt): Crawl policy for the apex. - [sitemap.xml](https://usesink.co/sitemap.xml): Every indexable URL on the site. ## Operations - [Health](https://usesink.co/health): Readiness of this deployment and its dependencies; answers 503 when a critical dependency (Postgres, master key) is gone, and reports degraded ones (read replica, Redis, Celery, billing) without failing. ## Legal - [Privacy Policy](https://usesink.co/legal/privacy): What Sink stores, for how long, and what it never has access to. - [Terms of Service](https://usesink.co/legal/terms): Terms covering use of the hosted service. - [Subprocessors](https://usesink.co/legal/subprocessors): Third parties that process data on Sink's behalf.