Share a private key

You can share the private key directly if your team's security model allows each recipient to retain a permanent copy outside your access controls.

Share the key

Find your private key with the keypair command.

$ npx dotenvx keypair
{"DOTENV_PUBLIC_KEY":"0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990","DOTENV_PRIVATE_KEY":"b37dbad0e00206f31486c4f44f8cc7abf2f1be96d5ba352eb791122b5e131bbf"}

$ pnpm exec dotenvx keypair
{"DOTENV_PUBLIC_KEY":"0220d830351410598be484f43a7b07097e09851f50426832876e8b5815a1752990","DOTENV_PRIVATE_KEY":"b37dbad0e00206f31486c4f44f8cc7abf2f1be96d5ba352eb791122b5e131bbf"}

Share the DOTENV_PRIVATE_KEY value through your team's approved private channel, such as Slack if your team permits it.

Use the shared key

Your teammate pulls the repository, then creates a .env.keys file at the project root. They put the private key you sent them in that file:

# .env.keys
DOTENV_PRIVATE_KEY="b37dbad0e00206f31486c4f44f8cc7abf2f1be96d5ba352eb791122b5e131bbf"

Keep .env.keys out of git. The encrypted .env file can stay committed alongside your code.

Run the app

With the dependencies installed, your teammate can start the app:

$ npm run dev

$ pnpm dev

Next.js loads and decrypts .env using their local private key. Visit http://localhost:3000/api/hello to see Hello Secret.

Anyone with a copy of the private key can decrypt files encrypted for that key. Removing their repository access does not revoke that copy. Use Armor when you want to manage access centrally.