Static builds

A static site uses secrets during the build, such as a token for fetching content from a CMS. The deployed site serves generated files and has no server process to decrypt secrets.

Use static output

Set output to static and remove the Node adapter from astro.config.mjs. Keep your other settings and integrations:

// astro.config.mjs
import { defineConfig } from 'astro/config';

export default defineConfig({
  output: 'static',
});

The main guide's index.astro example also works here. Its frontmatter runs at build time, so Hello Production becomes part of the generated HTML. Use real secrets only to perform server-side work; do not render them into the output.

Load secrets for the build

Follow Production to create and encrypt .env.production. For an Enclaved Key, select the service and resource that runs your build.

Use these scripts, keeping your other scripts and removing the Node server start script:

{
  "scripts": {
    "dev": "dotenvx run -- astro dev",
    "build": "dotenvx run -f .env.production --strict -- astro build",
    "preview": "astro preview"
  }
}

Run the build in the environment with access to the production key:

$ npm run build

$ pnpm build

For a local build, use the private key alternative and provide DOTENV_PRIVATE_KEY_PRODUCTION to your local build environment.

Deploy

Publish the dist directory to your static host. Only the build needs the key; do not include .env.production or .env.keys in the published files.

Rebuild when secrets or fetched content change. See Astro's deployment guide for hosting options.