# Fastify

## Prerequisites

Start with a [Fastify app](https://fastify.dev/docs/latest/Guides/Getting-Started/) and a supported Node.js LTS release. This guide uses Fastify 5.

## Install

In your Fastify project, install Dotenvx.

**npm**

```console
$ npm install @dotenvx/dotenvx
```

**pnpm**

```console
$ pnpm add @dotenvx/dotenvx
```

## Encrypt

Start with a secret value in the .env file at your project root, like:

```dotenv
# .env
HELLO="Secret"
```

Encrypt it with a single command.

**npm**

```console
$ npx dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉
```

**pnpm**

```console
$ pnpm exec dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉
```

The values become ciphertext and only your private key can unlock them.

```dotenv
# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"

HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="
```

## Commit

Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git.

```console
$ git add .env
$ git commit -m "encrypt .env"
```

## Ship

Read your value through process.env. Create server.mjs:

```js
// server.mjs
import Fastify from 'fastify'

const app = Fastify({ logger: true })

app.get('/', async () => {
  return `Hello ${process.env.HELLO}`
})

try {
  await app.listen({
    port: Number(process.env.PORT || 3000),
    host: process.env.HOST || '127.0.0.1'
  })
} catch (error) {
  app.log.error(error)
  process.exit(1)
}
```

HELLO is a demonstration value. Responses reach the browser; use real secrets inside server code without returning them.

Update these scripts in package.json, keeping your other scripts:

**package.json**

```json
{
  "scripts": {
    "dev": "dotenvx run --strict -- node server.mjs",
    "start": "dotenvx run -f .env.production --strict -- node server.mjs"
  }
}
```

Run your app:

**npm**

```console
$ npm run dev
⟐ injected env (2) from .env (022 0D8) via .env.keys
```

**pnpm**

```console
$ pnpm dev
⟐ injected env (2) from .env (022 0D8) via .env.keys
```

Dotenvx loads and decrypts .env before Fastify starts. Your routes and plugins can read the decrypted values through process.env.

Visit [http://localhost:3000](http://localhost:3000) to see Hello Secret.

Browser response at [http://localhost:3000](http://localhost:3000):

```text
Hello Secret
```

[**CommonJS** Alternative →](https://dotenvx.com/docs/fastify/commonjs.md)

## Share

Have teammates? Share access with Dotenvx Armor ⛨

Log in to Dotenvx.

**npm**

```console
$ npx dotenvx login
◉ logged in (username)
```

**pnpm**

```console
$ pnpm exec dotenvx login
◉ logged in (username)
```

Create the Armored Key ⛨

**npm**

```console
$ npx dotenvx armor up
⛨ armored .env (022 0D8)
```

**pnpm**

```console
$ pnpm exec dotenvx armor up
⛨ armored .env (022 0D8)
```

Invite your teammate.

**npm**

```console
$ npx dotenvx armor invite
⛨ invited person@example.com to team
```

**pnpm**

```console
$ pnpm exec dotenvx armor invite
⛨ invited person@example.com to team
```

Your teammate accepts the invitation, pulls the repository, installs dependencies, and logs in with dotenvx login. They can then run the app:

**npm**

```console
$ npm run dev
⟐ injected env (2) from .env (022 0D8) via Armor ⛨
```

**pnpm**

```console
$ pnpm dev
⟐ injected env (2) from .env (022 0D8) via Armor ⛨
```

Visit [http://localhost:3000](http://localhost:3000) to see Hello Secret.

Browser response at [http://localhost:3000](http://localhost:3000):

```text
Hello Secret
```

[**Share a private key** Alternative →](https://dotenvx.com/docs/fastify/share-private-key.md)

## Production

Create a .env.production file.

```dotenv
# .env.production
HELLO="Production"
```

Encrypt it with an Enclaved Key ◊

**npm**

```console
$ npx dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊
```

**pnpm**

```console
$ pnpm exec dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊
```

When prompted, choose **Enclaved**, select your deployment service, connection, and resource, and use DOTENV_PRIVATE_KEY_PRODUCTION as the private key name.

Commit .env.production.

```console
$ git add -f .env.production
$ git commit -m "encrypt .env.production"
```

Deploy your code, package.json, lockfile, and encrypted .env.production file to the selected resource. Install your dependencies there:

**npm**

```console
$ npm install
```

**pnpm**

```console
$ pnpm install
```

Keep .env.production at the project root and .env.keys on your local machine. This JavaScript example does not need a build step.

Set NODE_ENV to production, HOST to 0.0.0.0, and PORT to the port your host expects (3000 by default). From the project root, run:

**npm**

```console
$ npm start
```

**pnpm**

```console
$ pnpm start
```

Dotenvx loads and decrypts .env.production with your Enclaved Key ◊

Open your deployed app's URL to see Hello Production.

Browser response at [https://your-app.example.com](https://your-app.example.com):

```text
Hello Production
```

[**Deploy with a private key** Alternative →](https://dotenvx.com/docs/fastify/deploy-private-key.md)

## Conclusion

You've encrypted your secrets, shared access with Armor, and loaded production secrets in Fastify with an Enclaved Key. Your secrets now travel with your code.