# Import / Export
fnox can import secrets from various formats and export them for use in other tools.
## Import from Files
### From .env Files
```bash
# Import from .env file
fnox import -i .env
# Import and specify provider
fnox import -i .env --provider age
```
**Example .env file:**
```bash
DATABASE_URL=postgresql://localhost/mydb
API_KEY=sk_test_abc123
JWT_SECRET=super-secret-jwt-key
```
### From stdin
```bash
# Pipe from another source
# Using here-doc
fnox import << 'EOF'
DATABASE_URL=postgresql://localhost/mydb
API_KEY=sk_test_abc123
EOF
```
### From Different Formats
```bash
# JSON
fnox import -i secrets.json json
# YAML
fnox import -i secrets.yaml yaml
# TOML
fnox import -i secrets.toml toml
```
**Example secrets.json:**
```json
{
"DATABASE_URL": "postgresql://localhost/mydb",
"API_KEY": "sk_test_abc123"
}
```
**Example secrets.yaml:**
```yaml
DATABASE_URL: postgresql://localhost/mydb
API_KEY: sk_test_abc123
```
## Import Options
### With Provider
Encrypt secrets during import:
```bash
# Import and encrypt with age
fnox import -i .env --provider age
# Import and store in AWS Secrets Manager
fnox import -i .env --provider aws
```
### With Filters
Import only specific secrets:
```bash
# Import only secrets starting with "DATABASE_"
fnox import -i .env --filter "^DATABASE_"
# Import only API keys
fnox import -i .env --filter "^API_"
```
### With Prefix
Add a prefix to all imported secrets:
```bash
# Add "MYAPP_" prefix to all secrets
fnox import -i .env --prefix "MYAPP_"
# DATABASE_URL becomes MYAPP_DATABASE_URL
# API_KEY becomes MYAPP_API_KEY
```
### Combining Options
```bash
# Import DB secrets with encryption and prefix
fnox import -i .env \
--filter "^DATABASE_" \
--prefix "PROD_" \
--provider age
# DATABASE_URL → PROD_DATABASE_URL (encrypted with age)
# DATABASE_PASSWORD → PROD_DATABASE_PASSWORD (encrypted with age)
```
## Export Secrets
### Export Formats
```bash
# Export as .env format (default)
fnox export
# Export as JSON
fnox export --format json
# Export as YAML
fnox export --format yaml
# Export as TOML
fnox export --format toml
```
### Save to File
```bash
# Export to file
fnox export > .env
fnox export --format json > secrets.json
fnox export --format yaml > secrets.yaml
fnox export --format toml > secrets.toml
```
### Export with Profile
```bash
# Export production secrets
fnox export --profile production > .env.production
# Export staging secrets as JSON
fnox export --profile staging --format json > staging.json
```
## Migration Workflows
### From .env to fnox with Encryption
```bash
# 1. Set up age provider
cat >> fnox.toml << 'EOF'
[providers.age]
type = "age"
recipients = ["age1ql3z7hjy54pw3hyww5ayyfg7zqgvc7w3j2elw8zmrj2kg5sfn9aqmcac8p"]
EOF
# 2. Import and encrypt all secrets
fnox import -i .env --provider age
# 3. Remove .env file (secrets now encrypted in fnox.toml)
rm .env
```
### From fnox to .env (for legacy tools)
```bash
# Export current secrets to .env
fnox export > .env
```
### Between Providers
```bash
# 1. Export from AWS Secrets Manager
fnox export --profile production --format json > prod-secrets.json
# 2. Switch to age provider
cat >> fnox.toml << 'EOF'
[providers.age]
type = "age"
recipients = ["age1..."]
EOF
# 3. Re-import with new provider
fnox import -i prod-secrets.json json --provider age
# 4. Verify
fnox list
```
### Team Onboarding
```bash
# 1. Export example secrets (with dummy values)
fnox export --format json > secrets.example.json
# 2. Team member fills in real values
cp secrets.example.json secrets.json
# Edit secrets.json with real credentials
# 3. Import with encryption
fnox import -i secrets.json json --provider age
# 4. Delete plaintext file
rm secrets.json
```
## CI/CD Integration
### GitHub Actions Secrets → fnox
```yaml
# .github/workflows/setup-secrets.yml
jobs:
setup:
runs-on: ubuntu-latest
steps:
- name: Create secrets file
env:
DATABASE_URL: ${{ secrets.DATABASE_URL }}
API_KEY: ${{ secrets.API_KEY }}
run: |
cat > secrets.env << EOF
DATABASE_URL=$DATABASE_URL
API_KEY=$API_KEY
EOF
- name: Import to fnox
run: fnox import -i secrets.env --provider age
```
### fnox → Docker Compose
```bash
# Export for docker-compose
fnox export > .env
# Use in docker-compose.yml
# env_file:
# - .env
```
### fnox → Kubernetes Secrets
```bash
# Export as YAML
fnox export --format yaml > secrets.yaml
# Create Kubernetes secret
kubectl create secret generic app-secrets \
--from-env-file=<(fnox export)
```
## Next Steps
- [Providers](/providers/overview) - Choose providers for your secrets
- [Profiles](/guide/profiles) - Organize secrets by environment
- [Real-World Example](/guide/real-world-example) - Complete project setup