Next.js

Use Dotenvx with Next.js.

Prerequisites

Install

In your Next.js project, install Dotenvx and @dotenvx/next-env.

$ npm install @dotenvx/dotenvx
$ npm install @dotenvx/next-env

$ pnpm add @dotenvx/dotenvx
$ pnpm add @dotenvx/next-env

Add this override to your package manager’s configuration:

{
  "overrides": {
    "@next/env": "npm:@dotenvx/next-env"
  }
}

overrides:
  "@next/env": "npm:@dotenvx/next-env"

Apply it:

$ npm install

$ pnpm install

Next.js now loads encrypted secrets automatically through @dotenvx/next-env.

Encrypt

Start with a secret value in the .env file at your project root, like:

# .env
HELLO="Secret"

Encrypt it with a single command.

$ npx dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉

$ pnpm exec dotenvx encrypt
◈ encrypted .env (022 0D8) via .env.keys ⛉

The values become ciphertext and only your private key can unlock them.

# .env
DOTENV_PUBLIC_KEY="0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990"

HELLO="encrypted:BHLTACNJMr00nTG6yXpkCyWFKF/MY0ajN855tg3uVtKopTe2AGzSkQlcPd21pTOT3Ci8IKrdIg2TMZFoq1mDR6yb06QCRvqHXtpkZkAHYCEHfeWqqC8tMFovcYq5JS2uZSrC/qUGDA=="

Commit

Commit your encrypted .env files with your code. It's safe. Now you can securely share secrets through git. Keep .env.keys out of git. The -f flag adds the encrypted file even if your Next.js project ignores .env files.

$ git add -f .env
$ git commit -m "encrypt .env"

Ship

Read your secrets through process.env. Create app/api/hello/route.js:

// app/api/hello/route.js
import { connection } from 'next/server'

export async function GET() {
  await connection()
  return new Response(`Hello ${process.env.HELLO}`)
}

Run your app:

$ npm run dev
⟐ injected env (2) from .env (022 0D8) via .env.keys
▲ Next.js 16.4.1 (Turbopack)
- Local:         http://localhost:3000

$ pnpm dev
⟐ injected env (2) from .env (022 0D8) via .env.keys
▲ Next.js 16.4.1 (Turbopack)
- Local:         http://localhost:3000

Next.js loads and decrypts .env before your server code reads process.env.

Visit http://localhost:3000/api/hello to see Hello Secret.

Hello Secret

Seeing encrypted:ciphertext only? Troubleshoot →

Have teammates? Share access with Dotenvx Armor ⛨

$ npx dotenvx login
◉ logged in (username)

$ pnpm exec dotenvx login
◉ logged in (username)

Create the Armored Key ⛨

$ npx dotenvx armor up
⛨ armored .env (022 0D8)

$ pnpm exec dotenvx armor up
⛨ armored .env (022 0D8)

Invite your teammate.

$ npx dotenvx armor invite
⛨ invited [email protected] to team

$ pnpm exec dotenvx armor invite
⛨ invited [email protected] to team

They can now pull (git), decrypt, and run.

$ npm run dev
⟐ injected env (2) from .env (022 0D8) via Armor ⛨
▲ Next.js 16.4.1 (Turbopack)
- Local:         http://localhost:3000

$ pnpm dev
⟐ injected env (2) from .env (022 0D8) via Armor ⛨
▲ Next.js 16.4.1 (Turbopack)
- Local:         http://localhost:3000

Hello Secret

Not using Armor? Alternative →

Production

Create a .env.production file.

# .env.production
HELLO="Production"

Encrypt it with an Enclaved Key ◊

$ npx dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊

$ pnpm exec dotenvx encrypt -f .env.production
◈ encrypted .env.production (022 0D8) via Armor Enclave ◊

# 1. ⛨ Choose key type …
# ❯ ◊ Enclaved
# 2. ◊ Select service …
# ❯ Vercel
# 3. ◊ Select connection …
# 4. ◊ Select resource/project …
# 5. ? Private key name › DOTENV_PRIVATE_KEY_PRODUCTION

Commit .env.production.

$ git add -f .env.production
$ git commit -m "encrypt .env.production"

Deploy to Vercel.

$ npm install vercel --save-dev
$ npx vercel --prod

$ pnpm add -D vercel
$ pnpm exec vercel --prod

Vercel loads and decrypts .env.production with your Enclaved Key ◊

Visit https://your-app.vercel.app/api/hello to see Hello Production.

Hello Production

Not using Armor Enclaves? Alternative →

Conclusion

You've encrypted your secrets, shared access with Armor, and deployed to Vercel with Armor Enclaves.