When you add or edit an environment variable in Vercel, you now choose Config or Secret instead of using the Sensitive toggle.
Existing variables marked Sensitive are automatically treated as Secrets and continue to work without migration.
You can select an environment or Preview branch for each value. The in the dashboard shows each variable’s type and where it applies.environment variable list
The team policy is deprecated with this update. When enabled, it required every environment variable created by a team member to be Sensitive, including non-sensitive configuration. With Config and Secret types, members can choose the appropriate type for each variable.Enforce Sensitive Environment Variables
A new policy is available in your . When enabled, the Production value for a Secret must differ from the values used for the same key in Preview, Development, and custom environments.Separate Production Secret ValuesSecurity settings
If your team had the legacy policy enabled, confirm whether the Separate Production Secret Values policy should be enabled for your team. The deprecated policy is no longer enforced by the Vercel CLI.
To choose whether an environment variable is a Config or Secret from the CLI, pass or to or :--visibility config--visibility secretvercel env addvercel env update
The existing flags continue to work. When is omitted, maps to Config and maps to Secret. After adding or updating a variable, the CLI output shows its type under .--visibility--no-sensitive--sensitiveVisibility
Learn more in the .Environment Variables documentation
The value remains readable after saving for members with access. Use Config for non-sensitive values you may need to inspect later, such as variables with a public framework prefix.Config:
The value remains available to your deployments and can be replaced, but members cannot view or retrieve it after saving. Use Secret for passwords, API keys, and tokens.Secret: