Sync and rotate Vercel environment variables

Vercel stores environment variables per project and per environment (production, preview, development). Copying a new key into the dashboard by hand, for every project that uses it, is how a rotated key gets missed. dotsafe keeps each secret in one place and pushes the current value to your Vercel projects whenever it changes.

Connect Vercel

Create an access token at vercel.com/account/tokens, scoped to your team, then:

dotsafe connect vercel --name web                 # asks for the token

For a team, add its ID: --set team_id=team_…. The token is stored encrypted in your vault and only used from your Mac.

Push a secret to a project

dotsafe secret target add STRIPE_SECRET_KEY --connection web --set project=my-appdotsafe secret push STRIPE_SECRET_KEY             # push the current value now

By default it's set for all three Vercel environments. To limit it:

dotsafe secret target add STRIPE_SECRET_KEY --connection web --set project=my-app --set environments=production

Rotate once, everywhere

dotsafe secret rotate STRIPE_SECRET_KEY

The new value goes live in every dotsafe environment that links the secret and is pushed to every Vercel project you added. With a provider connected (OpenAI, Cloudflare, AWS), dotsafe also creates the new key for you. Redeploy on Vercel for running deployments to pick it up.

Local development

Run next dev with the same variables, instead of vercel env pull into a .env file:

dotsafe run -- next dev

See also dotsafe for Next.js and Integrations.