Encrypt a .env file in Turborepo

Encrypt a Turborepo workspace .env file and inject its secrets when Turbo runs the application.

1. Encrypt

Keep the environment file beside the workspace that uses it and encrypt it.

dotenvx encrypt -f apps/web/.env

Commit apps/web/.env, but never commit apps/web/.env.keys.

Point -f at the workspace directory and run Turbo through dotenvx.

dotenvx run -f apps/web -- npx turbo dev --filter=web

Dotenvx resolves apps/web/.env, decrypts it, and injects its values into the Turbo process.

Keep the same command in the root package scripts if the team runs it frequently.

{
  "scripts": {
    "dev:web": "dotenvx run -f apps/web -- turbo dev --filter=web"
  }
}

Declare environment variables that affect task outputs in turbo.json as required by Turborepo's environment-variable configuration.

For a shared root .env or separate .env.keys location, see Secrets in monorepos.