Fastify

Prerequisites

Start with a Fastify app and a supported Node.js LTS release. This guide uses Fastify 5.

Install

In your Fastify project, install Dotenvx.

$ npm install @dotenvx/dotenvx

$ pnpm add @dotenvx/dotenvx

Encrypt

Start with a secret value in the .env file at your project root, like:

# .env
HELLO="Secret"

Encrypt it with a single command.

$ npx dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉

$ pnpm exec dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉

The values become ciphertext and only your private key can unlock them.

# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"

HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="

Commit

Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git.

$ git add .env
$ git commit -m "encrypt .env"

Ship

Read your value through process.env. Create server.mjs:

// server.mjs
import Fastify from 'fastify'

const app = Fastify({ logger: true })

app.get('/', async () => {
  return `Hello ${process.env.HELLO}`
})

try {
  await app.listen({
    port: Number(process.env.PORT || 3000),
    host: process.env.HOST || '127.0.0.1'
  })
} catch (error) {
  app.log.error(error)
  process.exit(1)
}

HELLO is a demonstration value. Responses reach the browser; use real secrets inside server code without returning them.

Update these scripts in package.json, keeping your other scripts:

{
  "scripts": {
    "dev": "dotenvx run --strict -- node server.mjs",
    "start": "dotenvx run -f .env.production --strict -- node server.mjs"
  }
}

Run your app:

$ npm run dev
⟐ injected env (2) from .env (022 0D8) via .env.keys

$ pnpm dev
⟐ injected env (2) from .env (022 0D8) via .env.keys

Dotenvx loads and decrypts .env before Fastify starts. Your routes and plugins can read the decrypted values through process.env.

Visit http://localhost:3000 to see Hello Secret.

CommonJS Alternative →

Share

Have teammates? Share access with Dotenvx Armor ⛨

Log in to Dotenvx.

$ npx dotenvx login
◉ logged in (username)

$ pnpm exec dotenvx login
◉ logged in (username)

Create the Armored Key ⛨

$ npx dotenvx armor up
⛨ armored .env (022 0D8)

$ pnpm exec dotenvx armor up
⛨ armored .env (022 0D8)

Invite your teammate.

$ npx dotenvx armor invite
⛨ invited [email protected] to team

$ pnpm exec dotenvx armor invite
⛨ invited [email protected] to team

Your teammate accepts the invitation, pulls the repository, installs dependencies, and logs in with dotenvx login. They can then run the app:

$ npm run dev
⟐ injected env (2) from .env (022 0D8) via Armor ⛨

$ pnpm dev
⟐ injected env (2) from .env (022 0D8) via Armor ⛨

Visit http://localhost:3000 to see Hello Secret.

Share a private key Alternative →

Production

Create a .env.production file.

# .env.production
HELLO="Production"

Encrypt it with an Enclaved Key ◊

$ npx dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊

$ pnpm exec dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊

When prompted, choose Enclaved, select your deployment service, connection, and resource, and use DOTENV_PRIVATE_KEY_PRODUCTION as the private key name.

Commit .env.production.

$ git add -f .env.production
$ git commit -m "encrypt .env.production"

Deploy your code, package.json, lockfile, and encrypted .env.production file to the selected resource. Install your dependencies there:

$ npm install

$ pnpm install

Keep .env.production at the project root and .env.keys on your local machine. This JavaScript example does not need a build step.

Set NODE_ENV to production, HOST to 0.0.0.0, and PORT to the port your host expects (3000 by default). From the project root, run:

$ npm start

$ pnpm start

Dotenvx loads and decrypts .env.production with your Enclaved Key ◊

Open your deployed app's URL to see Hello Production.

Deploy with a private key Alternative →

Conclusion

You've encrypted your secrets, shared access with Armor, and loaded production secrets in Fastify with an Enclaved Key. Your secrets now travel with your code.