diff --git a/internal/devconfig/config.go b/internal/devconfig/config.go
index bc2442cbe57..a0ca4fba630 100644
--- a/internal/devconfig/config.go
+++ b/internal/devconfig/config.go
@@ -28,7 +28,7 @@ type Config struct {
 	Env map[string]string `json:"env,omitempty"`
 
 	// Only allows "envsec" for now
-	FromEnv string `json:"from_env,omitempty"`
+	EnvFrom string `json:"env_from,omitempty"`
 
 	// Shell configures the devbox shell environment.
 	Shell *shellConfig `json:"shell,omitempty"`
diff --git a/internal/devconfig/env.go b/internal/devconfig/env.go
index 55ff62428db..2ae98a03200 100644
--- a/internal/devconfig/env.go
+++ b/internal/devconfig/env.go
@@ -10,13 +10,13 @@ func (c *Config) ComputedEnv(projectDir string) (map[string]string, error) {
 	env := map[string]string{}
 	var err error
 	if featureflag.Envsec.Enabled() {
-		if c.FromEnv == "envsec" {
+		if c.EnvFrom == "envsec" {
 			env, err = envsec.Env(projectDir)
 			if err != nil {
 				return nil, err
 			}
-		} else if c.FromEnv != "" {
-			return nil, usererr.New("unknown from_env value: %s", c.FromEnv)
+		} else if c.EnvFrom != "" {
+			return nil, usererr.New("unknown from_env value: %s", c.EnvFrom)
 		}
 	}
 	for k, v := range c.Env {
diff --git a/internal/integrations/envsec/envsec.go b/internal/integrations/envsec/envsec.go
index e71e0cd4503..42479cb28b2 100644
--- a/internal/integrations/envsec/envsec.go
+++ b/internal/integrations/envsec/envsec.go
@@ -1,6 +1,7 @@
 package envsec
 
 import (
+	"bytes"
 	"encoding/json"
 	"os/exec"
 
@@ -15,7 +16,7 @@ func Env(projectDir string) (map[string]string, error) {
 		return nil, err
 	}
 
-	if err := ensureEnvsecInitialized(); err != nil {
+	if err := ensureEnvsecInitialized(projectDir); err != nil {
 		return nil, err
 	}
 
@@ -29,22 +30,30 @@ func ensureEnvsecInstalled() error {
 	return nil
 }
 
-func ensureEnvsecInitialized() error {
-	cmd := exec.Command("envsec", "init")
-	// TODO handle user not logged in
-	// envsec init is currently broken in that it exits with 0 even if the user is not logged in
-	return cmd.Run()
+func ensureEnvsecInitialized(projectDir string) error {
+	cmd := exec.Command("envsec", "init", "--json-errors")
+	cmd.Dir = projectDir
+	var bufErr bytes.Buffer
+	cmd.Stderr = &bufErr
+
+	if err := cmd.Run(); err != nil {
+		return handleError(&bufErr, err)
+	}
+	return nil
 }
 
 func envsecList(projectDir string) (map[string]string, error) {
 	cmd := exec.Command(
 		"envsec", "ls", "--show",
 		"--format", "json",
-		"--environment", "dev")
+		"--environment", "dev",
+		"--json-errors")
 	cmd.Dir = projectDir
+	var bufErr bytes.Buffer
+	cmd.Stderr = &bufErr
 	out, err := cmd.Output()
 	if err != nil {
-		return nil, errors.WithStack(err)
+		return nil, handleError(&bufErr, err)
 	}
 	var values []struct {
 		Name  string `json:"name"`
@@ -52,7 +61,7 @@ func envsecList(projectDir string) (map[string]string, error) {
 	}
 
 	if err := json.Unmarshal(out, &values); err != nil {
-		return nil, errors.Wrap(err, "failed to parse envsec output")
+		return nil, errors.Wrapf(err, "failed to parse envsec output: %s", out)
 	}
 
 	m := map[string]string{}
@@ -61,3 +70,13 @@ func envsecList(projectDir string) (map[string]string, error) {
 	}
 	return m, nil
 }
+
+func handleError(stderr *bytes.Buffer, err error) error {
+	var errResponse struct {
+		Error string `json:"error"`
+	}
+	if err := json.Unmarshal(stderr.Bytes(), &errResponse); err == nil {
+		return usererr.New(errResponse.Error)
+	}
+	return errors.WithStack(err)
+}