Team Sharing
Share vaults with your team. Access is granted server-side, with no key exchange and no raw keys shared over Slack.
How It Works
1. You create a vault (a namespace) and add secrets, encrypted at rest server-side
2. You share it with a team → each member is granted access
3. Members sign in with SSO and pull; the server decrypts for anyone authorized
4. Every access is scoped and audited; revoke a member anytime
Access is governed by identity (WorkOS SSO) and least-privilege scopes, and every operation is recorded in the audit trail.
Create a Team
Terminal
$ mp team create backend
Team 'backend' created.
$ mp team list
ID NAME CREATED
t1a2b3c4 backend 2026-05-05
Invite Members
Terminal
# Invite with default "member" role
$ mp team invite sarah@acme.dev --team t1a2b3c4
# Invite as admin
$ mp team invite mike@acme.dev --team t1a2b3c4 --role admin
| Role | Permissions |
|---|---|
| owner | Full access + delete team + manage members |
| admin | Read + write secrets + invite members |
| member | Read + write secrets in shared vaults |
Share a Vault
Terminal
$ mp share <vault-id> --team t1a2b3c4
Vault shared with team t1a2b3c4.
After sharing, every team member can mp pull and mp get from the shared vault. Access is granted server-side; there is no key exchange.
Audit Trail
Every vault and secret operation is logged. Track who accessed what, when, and from where.
API
GET /audit-logs?vault_id=<id>&limit=50
[
{ "action": "set", "resource_type": "secret",
"resource_id": "STRIPE_KEY", "created_at": "2026-05-05T14:22:00Z" },
{ "action": "share", "resource_type": "vault",
"created_at": "2026-05-05T10:00:00Z" }
]
vs. dotenvx Team Sharing
MeowPass
- • Server-side access grant per member/team
- • Least-privilege scopes per identity (SSO)
- • Revoking access = remove the grant (instant)
- • Audit trail of every access
dotenvx
- • Share raw DOTENV_PRIVATE_KEY via Slack/1Password
- • Everyone uses the same key
- • Can't revoke without re-encrypting everything
- • No built-in audit trail (free tier)