ev access

Usage

ev access
ev access grant <email> [flags]
ev access revoke <email>
ev access rotate

Description

ev access manages who can read and write secrets for a project.

ev access

Lists all current team members and their roles:

alice@example.com   admin
bob@example.com     developer
carol@example.com   viewer

ev access grant

Invites a user to the project. ev handles the key exchange automatically:

1. ev fetches the invitee's public key from the ev server (they must have run ev login at least once)
2. ev seals the project key with their public key
3. The sealed key is stored server-side — the invitee can now decrypt secrets

ev access grant bob@example.com

Use -r / --role to assign a specific role. The default is developer.

ev access revoke

Removes a user's access. After revocation, they can no longer pull secrets. Their previously cached project key remains valid until you run ev access rotate.

ev access revoke bob@example.com

ev access rotate

Generates a new project key, re-encrypts all secrets, re-seals the key for all current members, and prints a passphrase that can be used by new members to join via ev init --passphrase.

ev access rotate

Run this after revoking access to ensure the revoked member can no longer use a cached key.

Flags

ev access grant

Examples

List team members:

ev access

Grant access with the default developer role:

ev access grant alice@example.com

Grant access with a specific role:

ev access grant carol@example.com -r viewer

Revoke access and rotate the key:

ev access revoke bob@example.com
ev access rotate

Related

• Team Management
• Core Concepts — Roles
• ev init