Framework support

Dotvault for Next.js

Dotvault for Next.js projects.

Next.js splits environment variables into server-only and client-exposed (the NEXT_PUBLIC_ prefix). Get that wrong and you either leak a secret to the browser or crash in production. Dotvault knows the conventions and labels every NEXT_PUBLIC_ variable as client-exposed as you edit, so the boundary is marked in the file rather than something you hold in your head. Put a value under that prefix which can only be a secret and it says so outright, gitignored file or not, because the bundle ships either way.

What you get

  • →Detects Next.js automatically from package.json.
  • →Recognises NEXTAUTH_URL, NEXTAUTH_SECRET, and the NEXT_PUBLIC_ prefix out of the box.
  • →Warns when a NEXT_PUBLIC_ value can only be a secret: a Stripe or Anthropic secret key, a GitHub or Slack token, an AWS access key id, a webhook signing secret, or a key named SECRET, PASSWORD or PRIVATE_KEY.
  • →Leaves publishable keys alone. A pk_live_ value under NEXT_PUBLIC_ is the prefix working as intended, and a warning you could only clear by deleting working code is one you would learn to scroll past.
  • →Flags values matching a known secret pattern in any file git can see. That is the separate, older check, and it is the one that stays quiet on a gitignored file like .env.local.
  • →Handles .env.local, .env.development, .env.production, and .env.test side by side.

Known environment variables

Dotvault recognises these variables when you open a Next.js project and surfaces helpful descriptions and warnings in the editor. Next.js is detected via next in package.json.

  • NEXT_PUBLIC_

    Client-exposed variable (Next.js)

  • NEXTAUTH_URL

    NextAuth.js callback URL

  • NEXTAUTH_SECRET

    NextAuth.js secret for JWT encryption

  • NEXT_TELEMETRY_DISABLED

    Disable Next.js telemetry

  • NEXT_SHARP_PATH

    Custom path to sharp binary for image optimisation

  • HOSTNAME

    Server hostname for standalone mode

  • PORT

    Server listen port

  • ANALYZE

    Enable bundle analyzer

Official Next.js docs: nextjs.org/docs