# Astro
## Prerequisites
Create an [Astro app](https://docs.astro.build/en/install-and-setup/).
## Install
In your Astro project, install Dotenvx and the [Node.js adapter](https://docs.astro.build/en/guides/integrations-guide/node/). This guide uses server rendering on Node.js.
**npm**
```console
$ npm install @dotenvx/dotenvx @astrojs/node
```
**pnpm**
```console
$ pnpm add @dotenvx/dotenvx @astrojs/node
```
## Encrypt
Start with a secret value in the .env file at your project root, like:
```dotenv
# .env
HELLO="Secret"
```
Encrypt it with a single command.
**npm**
```console
$ npx dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉
```
**pnpm**
```console
$ pnpm exec dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉
```
The values become ciphertext and only your private key can unlock them.
```dotenv
# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"
HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="
```
## Commit
Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git.
```console
$ git add .env
$ git commit -m "encrypt .env"
```
## Ship
Configure Astro to render pages on the server. Merge these settings into astro.config.mjs, keeping your existing integrations:
```javascript
// astro.config.mjs
import { defineConfig } from 'astro/config';
import node from '@astrojs/node';
export default defineConfig({
output: 'server',
adapter: node({ mode: 'standalone' }),
});
```
Read your value in the page's server-side frontmatter:
```astro
---
// src/pages/index.astro
const hello = process.env.HELLO;
---
Dotenvx + Astro
Hello {hello}
```
HELLO is a demonstration value. Use real secrets in server-side operations without rendering them into HTML.
Update these scripts in package.json, keeping your other scripts:
**package.json**
```json
{
"scripts": {
"dev": "dotenvx run -- astro dev",
"build": "astro build",
"preview": "dotenvx run -- astro preview",
"start": "dotenvx run -f .env.production --strict -- node dist/server/entry.mjs"
}
}
```
Run your app:
**npm**
```console
$ npm run dev
⟐ injected env (2) from .env (022 0D8) via .env.keys
```
**pnpm**
```console
$ pnpm dev
⟐ injected env (2) from .env (022 0D8) via .env.keys
```
Dotenvx loads and decrypts .env before Astro starts. This page reads process.env on the server at request time.
Visit [http://localhost:4321](http://localhost:4321) to see Hello Secret.
Browser response at [http://localhost:4321](http://localhost:4321):
```text
Hello Secret
```
[**Public browser variables** Alternative →](https://dotenvx.com/docs/astro/public-variables.md)
[**Static builds** Alternative →](https://dotenvx.com/docs/astro/static-builds.md)
## Share
Have teammates? Share access with Dotenvx Armor ⛨
Log in to Dotenvx.
**npm**
```console
$ npx dotenvx login
◉ logged in (username)
```
**pnpm**
```console
$ pnpm exec dotenvx login
◉ logged in (username)
```
Create the Armored Key ⛨
**npm**
```console
$ npx dotenvx armor up
⛨ armored .env (022 0D8)
```
**pnpm**
```console
$ pnpm exec dotenvx armor up
⛨ armored .env (022 0D8)
```
Invite your teammate.
**npm**
```console
$ npx dotenvx armor invite
⛨ invited person@example.com to team
```
**pnpm**
```console
$ pnpm exec dotenvx armor invite
⛨ invited person@example.com to team
```
Your teammate accepts the invitation, pulls the repository, installs dependencies, and logs in with dotenvx login. They can then run the app:
**npm**
```console
$ npm run dev
⟐ injected env (2) from .env (022 0D8) via Armor ⛨
```
**pnpm**
```console
$ pnpm dev
⟐ injected env (2) from .env (022 0D8) via Armor ⛨
```
Visit [http://localhost:4321](http://localhost:4321) to see Hello Secret.
Browser response at [http://localhost:4321](http://localhost:4321):
```text
Hello Secret
```
[**Share a private key** Alternative →](https://dotenvx.com/docs/astro/share-private-key.md)
## Production
Create a .env.production file.
```dotenv
# .env.production
HELLO="Production"
```
Encrypt it with an Enclaved Key ◊
**npm**
```console
$ npx dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊
```
**pnpm**
```console
$ pnpm exec dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊
```
When prompted, choose **Enclaved**, select your deployment service, connection, and resource, and use DOTENV_PRIVATE_KEY_PRODUCTION as the private key name.
Commit .env.production.
```console
$ git add -f .env.production
$ git commit -m "encrypt .env.production"
```
Install dependencies and build your app in your deployment build step:
**npm**
```console
$ npm install
$ npm run build
```
**pnpm**
```console
$ pnpm install
$ pnpm build
```
This server-rendered example only needs its secret at runtime, so the build script does not decrypt it.
Deploy the compiled dist directory, package.json, runtime dependencies, and encrypted .env.production file to the selected resource. Keep .env.production at the project root and .env.keys on your local machine.
Set HOST to 0.0.0.0 and PORT to the port your host expects. From the project root, run:
**npm**
```console
$ npm start
```
**pnpm**
```console
$ pnpm start
```
Dotenvx loads and decrypts .env.production with your Enclaved Key ◊
Open your deployed app's URL to see Hello Production.
Browser response at [https://your-app.example.com](https://your-app.example.com):
```text
Hello Production
```
Use the start script for production; preview is for checking a build locally.
[**Deploy with a private key** Alternative →](https://dotenvx.com/docs/astro/deploy-private-key.md)
## Conclusion
You've encrypted your secrets, shared access with Armor, and loaded production secrets in Astro with an Enclaved Key. Your secrets now travel with your code.