DotEnv Studio — .env Generator, API Keys & Secret Scanner

Turn API docs into a safe .env file. Finds the variables an integration needs and warns before a real key reaches your code.

Turn messy API documentation into a clean, ready-to-use .env file — without ever leaking a real secret. DotEnv Studio is a privacy-first developer tool that reads the API docs page you're on, finds every environment variable and API key you need, generates a safe .env.example, and scans for exposed secrets — all locally in your browser. No backend. No AI. No tracking. No account. ━━━━━━━━━━━━━━━━━━━━━━━━ WHAT IT DOES ━━━━━━━━━━━━━━━━━━━━━━━━ ⌖ AUDIT ANY API DOCS IN ONE CLICK Open a docs page, click once, and DotEnv Studio extracts required environment variables, API key names, OAuth client IDs and secrets, webhook signing secrets, SDK install commands, required scopes, callback URLs, and the authentication method. ⌗ GENERATE A SAFE .env.example INSTANTLY Get a clean, grouped, commented .env file with every variable you need — values left blank, server-only keys clearly marked. Copy or download in one click. Toggle comments and grouping to taste. 🛡 SCAN FOR EXPOSED SECRETS Recognizes the key formats used by major API providers, masks anything that looks live, and guarantees real values are never written into exports or prompts. Flags the dangerous mistakes: secrets sitting behind a public client-side prefix, and privileged keys exposed to the browser. ✓ KNOWS A REAL KEY FROM A FAKE ONE Documentation is full of example keys. DotEnv Studio recognizes placeholder values and ignores them — so a page of samples doesn't cry wolf, and when you do get a warning, it's real. ✦ SAFE AI CODING PROMPTS Generate a ready-to-paste implementation prompt for your AI coding assistant — with required variables as placeholders only. Real keys are redacted automatically, every time. ⚙ STACK-AWARE OUTPUT Setup guidance adapts to the project you're building: where the env file belongs, which variables are safe to expose to the browser and which must stay on the server, the folder layout to expect, and an integration and testing checklist to work through. 📊 SECURITY SCORE Every audit gets an A–F grade with the exact factors that moved it, so you fix the right things before you ship. 🔎 ANALYZE YOUR LOCAL PROJECT Point it at your project folder and it reads your dependency manifest, env files, and source — locally — to find missing credentials, variables used but never declared, committed secrets, and browser-extension permission issues. 📁 PROJECTS, HISTORY & EXPORT Organize providers into projects, tag them, track status from planned to tested, merge a whole project into one .env.example, and export your env template, a setup guide, a security checklist, a team handoff doc, raw JSON, or a copy-ready prompt. Full local backup and restore. ━━━━━━━━━━━━━━━━━━━━━━━━ BEYOND THE AUDIT ━━━━━━━━━━━━━━━━━━━━━━━━ ⛨ A PRE-COMMIT HOOK FOR YOUR REPO Generate a dependency-free staged-secret guard that blocks a commit containing a live credential. It carries the same detection patterns and the same placeholder filter, so example keys in a README won't stop you — a real key will. This is the piece that keeps protecting you after you close the browser. ⌁ TYPED ENVIRONMENT Export type definitions or a validation schema for your project, so a missing variable breaks your build instead of your production deploy — using the same server and client split DotEnv Studio already worked out, so a secret can't slip into the browser bundle. ⇄ COMPARE YOUR ENVIRONMENTS Paste your local, staging, and production env files and compare them side by side. It separates "missing entirely" from "declared but empty" — which is almost always the variable you forgot to add to production. ⧗ CREDENTIAL ROTATION A key that was fine the day you issued it is a liability two years later, and nothing normally reminds you. Set an issue date and a rotation window per variable, then see what's overdue, what's due soon, and which secrets you aren't tracking at all. Dates only — never the credential. ⌖ CREDENTIAL DASHBOARD MODE Scanning a provider's own API keys page switches to strict mode — nothing there is an example, so every key-shaped string on screen is treated as live. 📋 PASTE GUARD Paste a real key into a note by accident and it's stripped before it's ever saved. 📈 WHOLE-PROJECT POSTURE One grade for your entire app, not just one integration: it starts from your weakest provider, then subtracts cross-provider conflicts, overdue rotations, and client-exposure risks. 📚 TEACH IT YOUR OWN PROVIDERS The built-in catalog covers the common services. Add your internal API or a niche SDK — variables, docs host, even a custom key pattern — and it gets the same warnings and scanning everywhere else in the app. Export the catalog so your whole team shares one set of rules. 🤝 SHARE WITHOUT A SERVER Hand a teammate one project as a file: variable names, flags, checklists and rotation windows — never values. Bundles are checksummed, so an edited file is refused on import. 🔍 PUBLIC REPO SCAN (OPTIONAL) Check whether a real key was ever committed to a public repository, and whether your env file is properly ignored by version control. This is the only feature that uses the network: it's switched off until you turn it on, it asks permission at the moment you use it, it contacts one service and nothing else, and turning it off revokes that access again. Everything else runs entirely offline. ━━━━━━━━━━━━━━━━━━━━━━━━ PRIVACY YOU CAN VERIFY ━━━━━━━━━━━━━━━━━━━━━━━━ • By default, zero network requests. No servers, no APIs, no CDNs, no remote scripts. • Reads a page only when YOU click — no background scanning, crawling, or navigation. • Real secret values are never stored, never exported, never put into prompts. • Everything stays in your browser's local storage. Clear it anytime. • No analytics. No tracking. No account.