# Deploy with a private key

[← Back to Express](https://dotenvx.com/docs/express.md#production)

You can manage the production private key yourself if your team's security model allows permanent copies on developer machines outside your deployment platform. Anyone who obtains a copy can decrypt your production secrets.

Store the key locally and add it to your deployment environment instead of using Armor Enclaves.

## Encrypt for production

Encrypt it. When prompted, choose **Local**, then your preferred storage option.

**npm**

```console
$ npx dotenvx encrypt -f .env.production
```

**pnpm**

```console
$ pnpm exec dotenvx encrypt -f .env.production
```

## Get the private key

Use keypair to retrieve your production private key:

**npm**

```console
$ npx dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015
```

**pnpm**

```console
$ pnpm exec dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015
```

## Configure your deployment

In your deployment environment, set DOTENV_PRIVATE_KEY_PRODUCTION to the value printed by your command. Set DOTENV_FILE to .env.production so Dotenvx loads the matching file.

Example deployment environment variables:

```dotenv
DOTENV_PRIVATE_KEY_PRODUCTION="c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015"
DOTENV_FILE=".env.production"
```

Keep .env.keys out of git and off your server. Return to [Production](https://dotenvx.com/docs/express.md#production) to commit the encrypted file, deploy your code, and start your app with npm start or pnpm start.