Environment variables now use Config and Secret types
By Steven Van ·
When you add or edit an environment variable in Vercel, you now choose Config or Secret instead of using the Sensitive toggle.
Vercel replaces the Sensitive toggle on Vercel environment variables with new Config and Secret types. Config values stay readable after saving for members with access, useful for non-sensitive settings such as a variable with a public framework prefix. Secret values remain available to deployments but can no longer be viewed or retrieved once saved, for passwords, API keys and tokens. Existing variables marked Sensitive are automatically treated as Secrets, with no migration needed. Each value can still be scoped to an environment or Preview branch, and the dashboard's environment variable list now shows each variable's type and where it applies.
- The team policy Enforce Sensitive Environment Variables, which required every variable a member created to be Sensitive, is deprecated; members now choose Config or Secret per variable, and the Vercel CLI no longer enforces it.
- A new Separate Production Secret Values policy in Security settings requires a Secret's Production value to differ from the values used for the same key in Preview, Development and custom environments.
- The CLI's vercel env add and vercel env update commands take a --visibility flag set to config or secret. The older --sensitive and --no-sensitive flags still work and map to Secret and Config respectively.
