Next.js environment variables without .env.local
Next.js reads process.env before any .env file. Start next dev, next build and next start with npx getmyenv run and drop .env.local.
Oct 10, 2026 · 4 min read

1. Next.js reads process.env first
Next.js looks up each variable in this order and stops at the first match:
process.env.env.$(NODE_ENV).local.env.local, except whenNODE_ENVistest.env.$(NODE_ENV).env
run puts values in process.env, so no file can replace them. Move your current files in first:
npx getmyenv import --dry-run
npx getmyenv import.env and .env.local go to the folder's context, Development by default. Where both set a name, .env.local wins.
2. Develop
npx getmyenv run -- next devrun does not read .env files. Delete them when you are ready. Until you do, Next.js still fills any name the context does not set from .env.local.
3. Build: NEXT_PUBLIC_ is inlined
next build replaces process.env.NEXT_PUBLIC_* with the values it sees, in the JavaScript sent to the browser. Anyone who loads the page can read them. Run the build with the context you deploy, where the build runs. Production is Read-only, so that machine needs a server token in GETMYENV_TOKEN:
npx getmyenv run production -- next buildOnly put public values behind NEXT_PUBLIC_. set and import warn when such a name or value looks like a secret. A new public value needs a new build.
4. Start
Only the owner sets Read-only values, in the dashboard. On the server, set GETMYENV_TOKEN to a server token for Production. Then:
npx getmyenv run production -- next startServer code reads names without the prefix when it runs. With dynamic rendering, a changed value takes effect on the next restart, without a rebuild. run fetches the values from getmyenv each time it starts. If it can't reach the server, the command does not start. A running process keeps its values.
On Vercel or Netlify the platform reads its own copy: /docs/deploy-platforms.
5. Check what Next.js gets
npx getmyenv run production --explain -- next buildnpx getmyenv run --explain lists every name and where it comes from. Never values.
Related docs: How run works, Contexts, Machine access, Vercel and Netlify