Turborepo

Encrypt a Turborepo workspace .env file and inject its secrets when Turbo runs the application.

1. Encrypt

Keep the environment file beside the workspace that uses it and encrypt it. 
$ dotenvx encrypt -f apps/web/.env
Commit apps/web/.env, but never commit apps/web/.env.keys.

2. Run

Point -f at the workspace directory and run Turbo through dotenvx. 
$ dotenvx run -f apps/web -- npx turbo dev --filter=web
Dotenvx resolves apps/web/.env, decrypts it, and injects its values into the Turbo process.

3. Add a script

Keep the same command in the root package scripts if the team runs it frequently. 
{
  "scripts": {
    "dev:web": "dotenvx run -f apps/web -- turbo dev --filter=web"
  }
}

Declare environment variables that affect task outputs in turbo.json as required by Turborepo’s environment-variable configuration.

For a shared root .env or separate .env.keys location, see Secrets in monorepos.