# Deploy with a private key

[← Back to Next.js](https://dotenvx.com/docs/nextjs.md#production)

You can manage the production private key yourself if your team's security model allows permanent copies on developer machines outside your deployment platform. Anyone who obtains a copy can decrypt your production secrets.

Store the key locally and paste it into Vercel instead of using Armor Enclaves.

## Encrypt for production

Encrypt it. When prompted, choose **Local**, then your preferred storage option.

**npm**

```console
$ npx dotenvx encrypt -f .env.production
```

**pnpm**

```console
$ pnpm exec dotenvx encrypt -f .env.production
```

## Get the private key

Use keypair to retrieve your production private key:

**npm**

```console
$ npx dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015
```

**pnpm**

```console
$ pnpm exec dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015
```

## Add it to Vercel

Open your Vercel project's [Settings → Environment Variables](https://vercel.com/docs/environment-variables/managing-environment-variables). Add DOTENV_PRIVATE_KEY_PRODUCTION, paste the value printed by your command, and select **Production**. Save it.

Example deployment environment variables:

```dotenv
DOTENV_PRIVATE_KEY_PRODUCTION="c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015"
```