Use the CLI

The CLI loads secrets before your application imports any modules. Keep env = false in bunfig.toml and remove the Dotenvx import and config() call from index.ts.

Use these package scripts:

{
  "scripts": {
    "start": "bunx --bun dotenvx run --strict -- bun index.ts",
    "dev": "bunx --bun dotenvx run --strict -- bun --watch index.ts",
    "start:prod": "bunx --bun dotenvx run -f .env.production --strict -- bun index.ts"
  }
}

The --bun flag runs the Dotenvx CLI with Bun. Dotenvx then starts your app with the decrypted values in process.env.

Run locally

$ bun run start
⟐ injected env (2) from .env (022 0D8) via .env.keys
Server running on http://localhost:3000/

Use bun run dev to watch your code. Restart the command after changing an environment file so Dotenvx reloads it.

Run in production

Follow Production to encrypt and deploy .env.production and provision its key. Use the production script to select that file:

$ bun run start:prod

This script selects .env.production explicitly, so it does not need DOTENV_FILE.