Core Concepts

ioenv organizes configuration using a three-level hierarchy: Organization → Project → Environment.

Organization

An organization is the top-level container. It maps to your company or team. Each org has its own encryption key, members, and billing plan.

• Every user belongs to at least one org.
• Org admins manage members, roles, and billing.
• Org-level encryption key wraps all project secrets.

Project

A project represents a deployable unit — a service, app, or microservice. Projects belong to an organization.

• Each project has its own set of environments.
• Projects can be linked to external services (Cloudflare, Vercel, etc.) via integrations.
• API tokens are scoped to a project.

Environment

An environment holds a set of key-value pairs (variables and secrets). Every project starts with a _base environment.

Built-in Environments

Environment	Purpose
_base	Shared defaults inherited by all other environments
dev	Local development
staging	Pre-production testing
prod	Production

Inheritance

Environments inherit from _base. If a variable is defined in _base and not overridden in dev, the dev environment uses the _base value. Overrides take precedence.

Variables vs Secrets

	Variable	Secret
Stored as	Plaintext	AES-256-GCM encrypted
Visible in dashboard	Full value	Masked (••••••)
Exportable	Yes	Yes (with permission)
Audit logged	Yes	Yes

API Tokens

Scoped tokens provide programmatic access to a project's variables. Each token:

• Is bound to a single project.
• Has a defined set of permissions (read, write, admin).
• Is stored as a SHA-256 hash (the plaintext is shown only at creation time).
• Appears in the format ioenv_xxxxxxxxxxxx.

Audit Log

Every operation — create, read, update, delete — is recorded with:

• Actor: Who performed the action.
• IP address: Where the request originated.
• Timestamp: When it happened.
• Details: What changed (old value is not stored for secrets).

Retention depends on your plan: 7 days (Free), 90 days (Pro), 1 year (Team).