Skip to content

Home

env-loader-pro

Enterprise-Grade Configuration Management

Typed, validated, and secure environment variable loader for Python with automatic type casting, validation, secret masking, cloud secrets integration, and full observability.

Get Started View on GitHub

What Problem Does This Solve?

Traditional .env loaders are basic and unsafe. env-loader-pro provides enterprise-grade features for production environments:

  • Type Safety - Automatic casting to int, bool, list, etc.
  • Cloud Secrets - Azure Key Vault, AWS Secrets Manager integration
  • Audit Trail - Complete provenance tracking for compliance
  • Policy Enforcement - Policy-as-code for configuration governance
  • CI/CD Safe - All commands work without cloud credentials
  • Secret Security - Automatic masking, never logs secrets

Quick Start

pip install env-loader-pro

from env_loader_pro import load_env

config = load_env(
    required=["API_KEY"],
    types={"PORT": int, "DEBUG": bool},
    defaults={"PORT": 8080}
)

print(config["PORT"])   # 8080 (int)
print(config["DEBUG"])  # True (bool)

from env_loader_pro import load_env
from env_loader_pro.providers import AzureKeyVaultProvider

provider = AzureKeyVaultProvider(
    vault_url="https://myvault.vault.azure.net"
)

config = load_env(
    env="prod",
    providers=[provider],
    audit=True  # Track provenance
)

Key Features

  • Security First

    Automatic secret masking, audit trail, policy enforcement, and encrypted file support. Never logs secrets in plaintext.

    Learn More

  • Cloud Secrets

    Seamless integration with Azure Key Vault, AWS Secrets Manager, and AWS SSM Parameter Store. Secrets override local config.

    Learn More

  • Audit Trail

    Complete provenance tracking for compliance. Know exactly where each configuration value came from, without storing secrets.

    Learn More

  • Policy-as-Code

    Enforce configuration policies via JSON/YAML files. Require variables, forbid debug flags, enforce source requirements.

    Learn More

  • CI/CD Safe

    All CLI commands work without cloud credentials. Perfect for CI pipelines with deterministic behavior and proper exit codes.

    Learn More

  • Performance

    Caching, circuit breakers, and performance monitoring with SLAs. Cold start < 500ms, warm load < 50ms, cached < 5ms.

    Learn More

Configuration Precedence

env-loader-pro uses a deterministic precedence order for resolving configuration values:

graph TD
    A[Schema Defaults] --> B[Base .env]
    B --> C[.env.prod]
    C --> D[Docker/K8s Secrets]
    D --> E[System Environment]
    E --> F[Cloud Providers]
    F --> G[Final Config]

    style A fill:#e1f5ff
    style B fill:#e1f5ff
    style C fill:#e1f5ff
    style D fill:#fff4e1
    style E fill:#fff4e1
    style F fill:#ffe1e1
    style G fill:#e1ffe1

Priority Order (highest to lowest):

  1. Cloud providers (Azure Key Vault, AWS Secrets Manager)
  2. System environment variables
  3. Docker/K8s mounted secrets
  4. .env.{env} (environment-specific file)
  5. Base .env file
  6. Schema defaults

Learn More

Security Guarantees

Production Ready

env-loader-pro is designed with security as a first-class concern:

  • ✅ No secrets in logs - Automatic masking in all outputs
  • ✅ Audit trail - Complete provenance tracking without values
  • ✅ Policy enforcement - Require/forbid variables via policy files
  • ✅ Secret change detection - Prevent accidental exposure
  • ✅ CI/CD safe - No cloud access required for validation

Security Model

CLI Tool

The envloader command-line tool provides powerful operations:

# Validate configuration (CI-safe)
envloader validate --ci --required API_KEY PORT

# Show audit trail
envloader audit --json

# Explain precedence
envloader explain

# Configuration diff
envloader diff --ci --deny-secret-changes

CLI Reference

Installation

pip install env-loader-pro

# Azure Key Vault
pip install env-loader-pro[azure]

# AWS Secrets Manager
pip install env-loader-pro[aws]

# Everything
pip install env-loader-pro[all]

git clone https://github.com/shanen28/env-loader-pro.git
cd env-loader-pro
pip install -e ".[test,all]"

Documentation

  • Getting Started

    Installation, quick start, and basic usage examples.

  • Core Concepts

    Configuration precedence, type casting, validation, and schema support.

  • Providers

    Cloud secrets integration with Azure, AWS, Docker, and Kubernetes.

  • Enterprise Features

    Audit trail, failure policies, policy-as-code, and performance monitoring.

  • Security

    Security model, secret masking, encrypted files, and CI/CD safety.

  • Architecture

    Technical design, principles, and provider system.

Why env-loader-pro?

vs python-dotenv

Feature python-dotenv env-loader-pro
Load .env ✅ ✅
Type casting ❌ ✅
Validation ❌ ✅
Cloud secrets ❌ ✅
Audit trail ❌ ✅
Policy enforcement ❌ ✅
CI/CD safe ❌ ✅

Get Started

Ready to use env-loader-pro in your project?

Installation Guide Quick Start

License

Apache License 2.0 - See LICENSE file for details.