Setting Up dotenvx with Next.js

Dotenvx encrypts your .env files so you can commit them to git. Your app reads decrypted values through process.env, while the private decryption keys stay outside your repository.

Set up Next.js

Follow the canonical Next.js guide to install @dotenvx/dotenvx and @dotenvx/next-env, add the @next/env override, and encrypt your .env file. The guide includes the current configuration and troubleshooting steps.

Use your normal Next.js scripts (next dev, next build, and next start) and continue reading variables with process.env.

Deploy on Vercel

Use the same canonical Next.js integration on Vercel. Commit encrypted environment files, keep .env.keys out of deployment uploads, and configure the matching private keys in Vercel.

Configure keys for each Vercel environment you deploy to. Preview builds also use NODE_ENV=production, so Vercel’s Preview scope does not automatically select a different Next.js env file.

Migrating from the earlier instructions

After applying the canonical setup:

Remove dotenvx run -- wrappers from your Next.js scripts.
Remove instrumentation code added solely to call dotenvx.config(). Keep instrumentation used for other purposes.
Replace any dotenvx.get calls introduced by the old Vercel guide with process.env reads.
Keep your encrypted env files and configure their matching decryption keys on Vercel, then redeploy.

Resources

Next.js guide — Canonical integration with @dotenvx/next-env
Dotenvx documentation — CLI and SDK reference