Skip to main content
A React single-page app runs entirely in the browser, so treat every value it can read as public. Use Enkryptify secrets for non-sensitive configuration here and keep real secrets on a server.

​
Local development

To run your app locally with Enkryptify secrets, install the Enkryptify CLI and link it to your project, then prefix your usual start script with ek run --:
Replace dev with whatever script starts your app. ek run fetches your project’s secrets and injects them as environment variables for that command only.

​
Accessing secrets in React

With Vite (the default for new React apps), only variables prefixed with VITE_ are exposed to your code, through import.meta.env:
Vite inlines these at build time, so run your build through ek run:
Anything exposed to a React bundle ships to the browser. Never put a real secret in a VITE_ variable; use it only for public configuration such as an API base URL.

​
Deploying

Build with ek run -- npm run build so the VITE_ values are inlined, then deploy the static output. If your host runs the build, use a sync to provide those variables there.