Environment variables now use Config and Secret types
Environment variables now use Config and Secret types instead of the Sensitive toggle, with automatic migration of existing Sensitive variables. A new Separate Production Secret Values policy is available, and the legacy Enforce Sensitive Environment Variables policy is deprecated.
When you add or edit an environment variable in Vercel, you now choose Config or Secret instead of using the Sensitive toggle.
Existing variables marked Sensitive are automatically treated as Secrets and continue to work without migration.
You can select an environment or Preview branch for each value. The in the dashboard shows each variable’s type and where it applies.environment variable list
The team policy is deprecated with this update. When enabled, it required every environment variable created by a team member to be Sensitive, including non-sensitive configuration. With Config and Secret types, members can choose the appropriate type for each variable.Enforce Sensitive Environment Variables
A new policy is available in your . When enabled, the Production value for a Secret must differ from the values used for the same key in Preview, Development, and custom environments.Separate Production Secret ValuesSecurity settings
If your team had the legacy policy enabled, confirm whether the Separate Production Secret Values policy should be enabled for your team. The deprecated policy is no longer enforced by the Vercel CLI.
To choose whether an environment variable is a Config or Secret from the CLI, pass or to or :--visibility config--visibility secretvercel env addvercel env update
The existing flags continue to work. When is omitted, maps to Config and maps to Secret. After adding or updating a variable, the CLI output shows its type under .--visibility--no-sensitive--sensitiveVisibility
Learn more in the .Environment Variables documentation
The value remains readable after saving for members with access. Use Config for non-sensitive values you may need to inspect later, such as variables with a public framework prefix.Config:
The value remains available to your deployments and can be replaced, but members cannot view or retrieve it after saving. Use Secret for passwords, API keys, and tokens.Secret:
Team policy changes
Set variable types from the CLI
Source: original entry ↗
More from Vercel
Follow Vercel to get its new changes in your feed and email digest.
OpenAI Decisions API now available on AI Gateway
OpenAI's Decisions API is now accessible through Vercel's AI Gateway with an OpenAI-compatible endpoint, enabling decision models to answer typed questions and return probabilities, choices, and scores for routing, triage, and guardrails use cases. Support is available across the OpenAI SDK, AI SDK, HTTP API, and CLI with the latest versions.
Timestamp attributes now supported in Vercel Flags
Vercel Flags now supports timestamp attributes for entities, allowing you to create time-based targeting rules. Use this feature to run limited-time campaigns, show content between specific dates, or target users based on registration date.
Glyph Cluster now available in stealth on AI Gateway
Glyph Cluster, a reasoning model for coding and long-context analysis, is now available as a stealth model on Vercel's AI Gateway for Pro and Enterprise plan teams with purchased AI Gateway credits at no cost during the stealth period. The model supports function calling, streams responses, and can be accessed via AI SDK, OpenAI-compatible APIs, and coding agents.