Deploy with a private key

You can manage the production private key yourself if your team's security model allows permanent copies on developer machines outside your deployment platform. Anyone who obtains a copy can decrypt your production secrets.

Store the key locally and paste it into Vercel instead of using Armor Enclaves.

Encrypt for production

Encrypt it. When prompted, choose Local, then your preferred storage option.

$ npx dotenvx encrypt -f .env.production

$ pnpm exec dotenvx encrypt -f .env.production

Get the private key

Use keypair to retrieve your production private key:

$ npx dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015

$ pnpm exec dotenvx keypair DOTENV_PRIVATE_KEY_PRODUCTION -f .env.production
c09d6f8918835c82f0df3b7d100c501ac199af5a76405892d641def691b5f015

Add it to Vercel

Open your Vercel project's Settings → Environment Variables. Add DOTENV_PRIVATE_KEY_PRODUCTION, paste the value printed by your command, and select Production. Save it.