DOTENV_PRIVATE_KEY_PRODUCTION=key dotenvx run

Decrypt your encrypted `.env.production` by setting `DOTENV_PRIVATE_KEY_PRODUCTION` before dotenvx run.

$ touch .env.production
dotenvx set HELLO "production encrypted" -f .env.production
echo "console.log('Hello ' + process.env.HELLO)" > index.js

# check .env.keys for your privateKey
DOTENV_PRIVATE_KEY_PRODUCTION="122...0b8" dotenvx run -- node index.js
⟐ injected env (2) from .env.production
Hello production encrypted

Alternatively, this can be already set on your server or cloud provider.

You can also load this value from 1Password with op read.

DOTENV_PRIVATE_KEY_PRODUCTION="$(op read op://Engineering/my-app/DOTENV_PRIVATE_KEY_PRODUCTION)" dotenvx run -- node index.js

See Use dotenvx with 1Password.

Or load it from Bitwarden with bw get password.

export BW_SESSION="$(bw unlock --raw)"
DOTENV_PRIVATE_KEY_PRODUCTION="$(bw get password DOTENV_PRIVATE_KEY_PRODUCTION)" dotenvx run -- node index.js

See Use dotenvx with Bitwarden.

Note the DOTENV_PRIVATE_KEY_PRODUCTION ends with _PRODUCTION. This instructs dotenvx run to load the .env.production file.