relic check compares the keys your app needs with the secrets stored in a Relic environment. Run it before a deploy, in CI, or in a pre-push hook so a missing key fails the pipeline instead of the release.
The command reads secret names only. Values are never requested, decrypted, or printed, so relic check works without your password and without RELIC_PASSWORD.
Where Required Keys Come From
Relic merges every source it finds into one list of required keys.- Env templates.
.env.example,.env.sample, and.env.templatein the directory that containsrelic.toml. Relic reads the key names and ignores the values. Commented-out lines are skipped. --from <file>. Use one or more specific files instead of the default templates. Paths are relative to the current directory.--scan [paths...]. Statically scan source files for env reads. Without paths, Relic scans the project root.
What --scan Detects
Scanned extensions are
.js, .jsx, .mjs, .cjs, .ts, .tsx, .mts, .cts, .vue, .svelte, .astro, and .py.
Inside a git repository, Relic lists files with git, so everything in .gitignore is skipped. Outside git, Relic applies the patterns in the root .gitignore itself (negated ! patterns are not supported). Dependency and build directories such as node_modules, dist, build, .next, coverage, and .venv are always skipped. Vite built-ins (import.meta.env.MODE, DEV, PROD, SSR, BASE_URL) are not treated as required.
The scanner finds literal key names. Dynamic reads like
process.env[name] are not detected, and
reads with a fallback value (os.getenv("PORT", "3000")) still count as required. Add keys you
don’t need in Relic to the ignore list.Ignoring Keys
Some variables are set by your platform or tooling rather than Relic. Skip them inrelic.toml:
--ignore, which is merged with the config. Separate names with commas or repeat the flag. * matches any characters.
Reading the Output
- Missing: required by your code or templates, but not in the environment. Each key shows where it was found.
- Unused: in the environment, but not required by any source. This is informational unless you pass
--strict.
--folder, Relic checks the secrets at the root of the environment, which matches what relic run injects. Use -f and -s to check the same folder and scope you pass to relic run.
Comparing Environments
Use--compare to see which key names exist in only one of two environments, for example before promoting staging to production:
--compare works on its own or together with the required-key sources. Folder and scope filters apply to both environments.
Exit Codes
JSON Output
--json prints a machine-readable report to stdout. Errors are printed as { "ok": false, "error": "..." }.
required is null when only --compare is used. With --compare, compare contains base, other, onlyInBase, and onlyInOther.
Authentication
relic check uses the same credentials as relic run and makes one request per environment.
See CI/CD Integration for a pipeline example.