Environment variables now use Config and Secret types
Vercel has replaced the Sensitive toggle for environment variables with Config and Secret types, clarifying access controls and simplifying team policy management.
Vercel now requires users to select either Config or Secret when adding or editing environment variables, replacing the previous Sensitive toggle. Config variables remain readable for team members with access and are intended for non-sensitive values such as public framework prefixes. Secret variables are hidden after saving but remain available to deployments, making them suitable for passwords, API keys, and tokens. Existing Sensitive variables are automatically converted to Secrets without requiring migration.
The dashboard now displays each variable’s type and applicable environments, improving visibility. The Enforce Sensitive Environment Variables team policy, which previously forced all variables to be marked as Sensitive, has been deprecated. Teams can now choose the appropriate type for each variable, aligning with actual security needs. A new Separate Production Secret Values policy is available in Security settings to enforce distinct Secret values for Production compared to other environments.
For CLI users, the --visibility flag now supports config or secret when adding or updating variables via vercel env add or vercel env update. The existing --no-sensitive and --sensitive flags continue to function, mapping to Config and Secret respectively. After execution, the CLI output indicates the variable’s type under Visibility, ensuring clarity in variable management.
Teams using the legacy Enforce Sensitive Environment Variables policy should review whether the new Separate Production Secret Values policy aligns with their security requirements. The deprecated policy is no longer enforced by the Vercel CLI, allowing teams to adopt the updated system without disruption.