Skip to main content
Enkryptify injects your secrets as environment variables, so Next.js reads them the same way it reads any .env value, without a .env file on disk.

​
Local development

To run your app locally with Enkryptify secrets, install the Enkryptify CLI and link it to your project, then prefix your usual start script with ek run --:
Replace dev with whatever script starts your app. ek run fetches your project’s secrets and injects them as environment variables for that command only. This covers next dev, next build and next start alike, since each runs as the wrapped command.

​
Accessing secrets in Next.js

Server code (Server Components, Route Handlers, API routes, getServerSideProps) reads secrets directly from process.env:
Browser code can only read variables prefixed with NEXT_PUBLIC_, and Next.js inlines them at build time. Run your build through ek run so the values are present:
NEXT_PUBLIC_ variables are bundled into the client and visible to anyone. Never give a real secret a NEXT_PUBLIC_ name; use it only for non-sensitive configuration.

​
Deploying

On Vercel, use the Vercel sync to push secrets to your project’s environment variables. For other hosts, pick the matching sync or run your server with ek run.