EAS Build

Complete EAS Build setup for your project. Keep the encrypted .env.production from the main guide.

Wrapping eas build in Dotenvx only affects the local command. The remote worker needs its own key and decryption step.

Provide the key

Retrieve your production private key locally:

$ npx dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production

$ pnpm exec dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production

In your Expo project's Environment Variables settings, create DOTENV_PRIVATE_KEY_PRODUCTION in the production environment with Secret visibility. Set its value to your key. Keep it out of eas.json and your app config.

Configure the worker

Merge these settings into your production build profile in eas.json:

{
  "build": {
    "production": {
      "environment": "production",
      "env": {
        "EXPO_NO_DOTENV": "1"
      }
    }
  }
}

Load Dotenvx in metro.config.js on the EAS worker, before creating the Metro config. Preserve your existing Metro customizations:

// metro.config.js
const { getDefaultConfig } = require('expo/metro-config');

if (process.env.EAS_BUILD === 'true') {
  require('@dotenvx/dotenvx').config({
    path: '.env.production',
    strict: true,
  });
}

module.exports = getDefaultConfig(__dirname);

This loads the public values for bundling. Values needed earlier by app.config.js, config plugins, or native prebuild must be supplied separately through EAS configuration; Metro runs later.

Ensure the build archive includes encrypted .env.production and excludes .env.keys. If you use .easignore, keep its existing rules and add:

!.env.production
.env.keys*

If creating .easignore, start with your .gitignore rules. Avoid defining the same public variables in EAS and .env.production, since existing environment values take precedence.

Build

$ npx eas-cli@latest build --profile production

$ pnpm dlx eas-cli@latest build --profile production

The worker decrypts the file before Metro bundles the app. EXPO_PUBLIC_HELLO becomes a public app value; the private key stays in the build environment.

Follow the build's installation or submission instructions. See EAS environment variables for worker configuration details.