# Build-only secrets

[← Back to Expo](https://dotenvx.com/docs/expo.md#ship)

Tokens for uploading source maps or accessing private services belong in Node.js build scripts or your backend. Leave off the EXPO_PUBLIC_ prefix, and never copy them into app config's extra field or application code.

For example, add a build-only token to .env.production alongside your public configuration, then run dotenvx encrypt -f .env.production again.

```dotenv
# Build tooling only. Replace this example value with your token.
SENTRY_AUTH_TOKEN="example-only"
```

Run your tool through Dotenvx so it receives the decrypted environment:

**package.json**

```json
{
  "scripts": {
    "upload:sourcemaps": "dotenvx run -f .env.production --strict -- node scripts/upload-sourcemaps.cjs"
  }
}
```

The script is your existing source-map upload tool. It reads process.env.SENTRY_AUTH_TOKEN on the build machine. Do not import that script or @dotenvx/dotenvx into an Expo screen.

Removing the prefix alone does not protect a value that you manually put in app code, assets, or config. Anything shipped to a device can be inspected.