When you add or edit an environment variable in Vercel, you now choose Config or Secret instead of using the Sensitive toggle.

Config: The value remains readable after saving for members with access. Use Config for non-sensitive values you may need to inspect later, such as variables with a public framework prefix.

Secret: The value remains available to your deployments and can be replaced, but members cannot view or retrieve it after saving. Use Secret for passwords, API keys, and tokens.

Existing variables marked Sensitive are automatically treated as Secrets and continue to work without migration.

You can select an environment or Preview branch for each value. The environment variable list in the dashboard shows each variable’s type and where it applies.

Copy link to headingTeam policy changes

The Enforce Sensitive Environment Variables team policy is deprecated with this update. When enabled, it required every environment variable created by a team member to be Sensitive, including non-sensitive configuration. With Config and Secret types, members can choose the appropriate type for each variable.

A new Separate Production Secret Values policy is available in your Security settings. When enabled, the Production value for a Secret must differ from the values used for the same key in Preview, Development, and custom environments.

If your team had the legacy policy enabled, confirm whether the Separate Production Secret Values policy should be enabled for your team. The deprecated policy is no longer enforced by the Vercel CLI.

Copy link to headingSet variable types from the CLI

To choose whether an environment variable is a Config or Secret from the CLI, pass --visibility config

or --visibility secret

to vercel env add

or vercel env update

api.example.com" --visibility config --yes

Secretvercel env add API_KEY production --value "sk_live_..." --visibility secret --yes

Create Config and Secret environment variables with the Vercel CLI.

The existing flags continue to work. When --visibility

is omitted, --no-sensitive

maps to Config and --sensitive

maps to Secret. After adding or updating a variable, the CLI output shows its type under Visibility

Learn more in the Environment Variables documentation.

Environment variables must be designated as either Config or Secret instead of using a sensitive toggle when added or edited in Vercel.
Config values remain readable for members with access and are suitable for non-sensitive data.
Secret values remain inaccessible to members after saving and are intended for passwords, API keys, and tokens.
Existing variables marked Sensitive are automatically treated as Secrets without migration.
Users can select an environment or Preview branch for each variable.
The dashboard lists the type and applicability of each variable.
The CLI supports specifying visibility using `--visibility config` or `--visibility secret` with `vercel env add` or `vercel env update`.

Vercel now requires users to explicitly choose between Config and Secret when adding or editing environment variables, replacing the previous use of a sensitive toggle. Config values remain readable for members with access, suitable for non-sensitive data like public framework prefixes, while Secret values are kept private and restricted to deployments, intended for sensitive information such as API keys and tokens. Existing sensitive variables are automatically treated as Secrets without migration. Users can assign an environment or Preview branch to each variable, and the dashboard displays the type and scope of each variable. Furthermore, users can manage variable types via the Command Line Interface (CLI) by using flags like `--visibility config` or `--visibility secret` with commands such as `vercel env add` or `vercel env update`.

The shift from a binary sensitive toggle to explicit Config/Secret typing represents a design choice prioritizing granular control over data exposure, moving complexity from an implicit setting to an explicit configuration layer. This structure suggests an acknowledgment that environment variables serve distinct functional roles: some require shared visibility for operational clarity, while others necessitate strict access controls. The introduction of the "Separate Production Secret Values" policy indicates an attempt to address the potential synchronization risk between preview and production secrets, suggesting a pattern where historical deployment data is treated as critical context that must be explicitly managed across different environments. The CLI functionality allows power users to enforce these distinctions programmatically, which is a sign that system boundaries are being formalized for greater accountability rather than relying on blanket assumptions of sensitivity. The implication is that managing environment variables is moving from a state of simple marking (sensitive/not sensitive) to a state of defined policy application across the entire deployment lifecycle.

When you add or edit an environment variable in Vercel, you now choose Config or Secret instead of using the Sensitive toggle.

Config: The value remains readable after saving for members with access. Use Config for non-sensitive values you may need to inspect later, such as variables with a public framework prefix.

Secret: The value remains available to your deployments and can be replaced, but members cannot view or retrieve it after saving. Use Secret for passwords, API keys, and tokens.

Existing variables marked Sensitive are automatically treated as Secrets and continue to work without migration.

You can select an environment or Preview branch for each value. The environment variable list in the dashboard shows each variable’s type and where it applies.

Copy link to headingTeam policy changes

Copy link to headingSet variable types from the CLI

To choose whether an environment variable is a Config or Secret from the CLI, pass --visibility config

or --visibility secret

to vercel env add

or vercel env update

Configvercel env add API_URL production --value "https://api.example.com" --visibility config --yes

Secretvercel env add API_KEY production --value "sk_live_..." --visibility secret --yes

Create Config and Secret environment variables with the Vercel CLI.

The existing flags continue to work. When --visibility

is omitted, --no-sensitive

maps to Config and --sensitive

maps to Secret. After adding or updating a variable, the CLI output shows its type under Visibility

Learn more in the Environment Variables documentation.

Environment variables now use Config and Secret types

Configvercel env add API_URL production --value "https://api.example.com" --visibility config --yes

Secretvercel env add API_KEY production --value "sk_live_..." --visibility secret --yes

Facts Only

Executive Summary

Full Take

Environment variables now use Config and Secret types

Configvercel env add API_URL production --value "https://api.example.com" --visibility config --yes

Secretvercel env add API_KEY production --value "sk_live_..." --visibility secret --yes

Facts Only

Executive Summary

Full Take