porter env - Porter

porter env contains commands for managing environment groups — project-wide sets of environment variables and secrets that can be shared across applications.

Prerequisites

You’ve logged in to the Porter CLI after running porter auth login
You’re connected to the correct project by running porter config set-project

`porter env list`

List environment groups for the current project. Usage:

porter env list [flags]

Options:

Flag	Description
`--json`	Print environment groups as JSON instead of a table

When a cluster is set (via porter config set-cluster, the --cluster flag, or the PORTER_CLUSTER environment variable), the list is scoped to that cluster: environment groups whose sync targets include the cluster, plus any cluster-scoped environment groups. This matches what the dashboard shows on the cluster’s environment groups page. Without a cluster context, all environment groups in the project are listed. The default table output shows each group’s name, current version, and last updated time, sorted alphabetically by name.

porter env list

porter env list --json

The --json output returns two arrays — environment_groups and cluster_scoped_environment_groups — sharing one object shape:

{
  "environment_groups": [
    {
      "id": "2a54d3ab-08e2-4922-9368-a7e45ad87d23",
      "name": "tessier-internal",
      "current_version": 9,
      "created_at": "2026-02-25T09:23:16.332254Z",
      "updated_at": "2026-06-30T04:23:25.23501Z",
      "sync_target_cluster_ids": [11]
    }
  ],
  "cluster_scoped_environment_groups": [
    {
      "id": "",
      "name": "billing-db",
      "current_version": 202,
      "created_at": "2025-10-27T16:00:48Z",
      "updated_at": "2025-10-27T16:00:48Z",
      "sync_target_cluster_ids": [11]
    }
  ]
}

`porter env create`

Create a new environment group. Usage:

porter env create [flags]

Options:

Flag	Description
`--name`	Environment group name (prompted interactively if omitted)
`--variables`, `-v`	Variables to set as key=value pairs
`--secrets`, `-s`	Secrets to set as key=value pairs
`--no-input`	Disable interactive prompts

porter env create

porter env create --name production-secrets

porter env create --name production-secrets \
  -v NODE_ENV=production,LOG_LEVEL=info \
  -s DB_PASSWORD=secret,API_KEY=sk-123

If an environment group with the same name already exists, the command will fail. Use porter env set to update an existing group.

`porter env pull`

Pull environment variables from an environment group to your local machine. Usage:

porter env pull [-g] <env-group-name> [flags]

Options:

Flag	Short	Description
`--app`	`-a`	Target application
`--group`	`-g`	Target cluster environment group
`--variables`	`-v`	Output only variables (excludes secrets)
`--secrets`	`-s`	Output only secrets (excludes variables)
`--merged`		Include variables from all linked env groups (only valid with `--app`)

porter env pull production-secrets

porter env pull production-secrets -f .env.local

porter env pull production-secrets -v

porter env pull production-secrets -s

porter env pull --app my-app --merged

By default, both variables and secrets are output together. Use -v or -s to filter. You cannot use both flags at the same time.

`porter env set`

Add or update variables and secrets in an environment group. Usage:

porter env set <env-group-name> [flags]

Options:

Flag	Short	Description
`--variables`	`-v`	Variables to set as key=value pairs
`--secrets`	`-s`	Secrets to set as key=value pairs

porter env set production-secrets -v LOG_LEVEL=debug,FEATURE_FLAG=true

porter env set production-secrets -s API_KEY=sk-new-key

porter env set production-secrets \
  -v NODE_ENV=production,LOG_LEVEL=info \
  -s DATABASE_URL=postgres://...

Use -s/--secrets for sensitive values like API keys and passwords. Secrets are stored in your cloud provider’s secret manager and are not visible after creation.

When you update an environment group, all applications synced to it are automatically redeployed with the new values.

`porter env unset`

Remove variables or secrets from an environment group. Usage:

porter env unset <env-group-name> [flags]

Options:

Flag	Short	Description
`--variables`	`-v`	Comma-separated list of variable names to remove
`--secrets`	`-s`	Comma-separated list of secret names to remove

porter env unset production-secrets -v OLD_KEY,UNUSED_VAR

porter env unset production-secrets -s ROTATED_KEY,OLD_SECRET

porter env unset production-secrets -v VAR1 -s SECRET1

When you update an environment group, all applications synced to it are automatically redeployed with the new values.

Legacy Commands

The following flag-based syntax is supported for managing app-level and cluster-level environment variables. These are legacy commands — for environment groups, use the positional argument syntax above.

Legacy Flags

Flag	Short	Description
`--app`	`-a`	Target application
`--group`	`-g`	Target cluster environment group
`--target`	`-x`	Deployment target name
`--skip-redeploys`		Skip re-deploying apps linked to the cluster environment group

You must specify either --app or --group, but not both.

porter env pull --app my-app

porter env pull --group staging-config

porter env set --app my-app -v KEY1=value1,KEY2=value2

porter env set --group my-env-group -v KEY1=value1

porter env unset --app my-app -v KEY1,KEY2

porter env set --group my-env-group -v KEY=value --skip-redeploys

Environment Groups — Overview of environment groups
porter.yaml Reference — envGroups field in porter.yaml
porter app — Application management commands
porter apply — Deploy with porter.yaml

​Prerequisites

​porter env list

​porter env create

​porter env pull

​porter env set

​porter env unset

​Legacy Commands

​Legacy Flags

​Related

Prerequisites

`porter env list`

`porter env create`

`porter env pull`

`porter env set`

`porter env unset`

Legacy Commands

Legacy Flags

Related