Build-only secrets

Use credentials in build tooling without putting them in your Vite app.

Tokens for uploading source maps or accessing private services belong in Node.js build scripts or your backend. Leave off the VITE_ prefix, and never copy them into Vite's define option or application code.

For example, add a build-only token to .env.production alongside your public configuration, then run dotenvx encrypt -f .env.production again.

# Build tooling only. Replace this example value with your token.
SENTRY_AUTH_TOKEN="example-only"

Run your tool through Dotenvx so it receives the decrypted environment:

{
  "scripts": {
    "upload:sourcemaps": "dotenvx run -f .env.production --strict -- node scripts/upload-sourcemaps.cjs"
  }
}

The script is your existing source-map upload tool. It reads process.env.SENTRY_AUTH_TOKEN on the build machine. Do not import that script or @dotenvx/dotenvx into browser code.

Removing the prefix alone does not protect a value that you manually put in app code, assets, or config. Anything shipped to a browser can be inspected.