# EAS Build

[← Back to Expo](https://dotenvx.com/docs/expo.md#production)

Complete [EAS Build setup](https://docs.expo.dev/build/setup/) for your project. Keep the encrypted .env.production from the main guide.

Wrapping eas build in Dotenvx only affects the local command. The remote worker needs its own key and decryption step.

## Provide the key

Retrieve your production private key locally:

**npm**

```console
$ npx dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
```

**pnpm**

```console
$ pnpm exec dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
```

In your Expo project's Environment Variables settings, create DOTENV_PRIVATE_KEY_PRODUCTION in the production environment with **Secret** visibility. Set its value to your key. Keep it out of eas.json and your app config.

## Configure the worker

Merge these settings into your production build profile in eas.json:

**eas.json**

```json
{
  "build": {
    "production": {
      "environment": "production",
      "env": {
        "EXPO_NO_DOTENV": "1"
      }
    }
  }
}
```

Load Dotenvx in metro.config.js on the EAS worker, before creating the Metro config. Preserve your existing Metro customizations:

```javascript
// metro.config.js
const { getDefaultConfig } = require('expo/metro-config');

if (process.env.EAS_BUILD === 'true') {
  require('@dotenvx/dotenvx').config({
    path: '.env.production',
    strict: true,
  });
}

module.exports = getDefaultConfig(__dirname);
```

This loads the public values for bundling. Values needed earlier by app.config.js, config plugins, or native prebuild must be supplied separately through EAS configuration; Metro runs later.

Ensure the build archive includes encrypted .env.production and excludes .env.keys. If you use .easignore, keep its existing rules and add:

**.easignore**

```gitignore
!.env.production
.env.keys*
```

If creating .easignore, start with your .gitignore rules. Avoid defining the same public variables in EAS and .env.production, since existing environment values take precedence.

## Build

**npm**

```console
$ npx eas-cli@latest build --profile production
```

**pnpm**

```console
$ pnpm dlx eas-cli@latest build --profile production
```

The worker decrypts the file before Metro bundles the app. EXPO_PUBLIC_HELLO becomes a public app value; the private key stays in the build environment.

Follow the build's installation or submission instructions. See [EAS environment variables](https://docs.expo.dev/eas/environment-variables/usage/) for worker configuration details.