Deploy with a private key

Keep your production key locally and add it to your server yourself.

You can manage the production private key yourself if your team's security model allows permanent copies on developer machines outside your deployment platform. Anyone who obtains a copy can decrypt your production secrets.

Store the key locally and add it to your deployment environment instead of using Armor Enclaves.

Encrypt for production

Encrypt it. When prompted, choose Local, then your preferred storage option.

$ npx dotenvx encrypt -f .env.production

$ pnpm exec dotenvx encrypt -f .env.production

Get the private key

Use keypair to retrieve your production private key:

$ npx dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015

$ pnpm exec dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015

Configure your deployment

In your deployment environment, set DOTENV_PRIVATE_KEY_PRODUCTION to the value printed by your command. Set DOTENV_FILE to .env.production so Dotenvx loads the matching file.

Keep .env.keys out of git and off your server. Return to Production to commit the encrypted file, deploy your code, and start your app with npm start or pnpm start.