Skip to content

Push a context to Vercel or Netlify

Copy a getmyenv context to Vercel or Netlify with npx getmyenv push. Dry run first, then push with your own platform token. Public prefixes, targets and prune.

Oct 10, 2026 · 5 min read

An encrypted context, one push command, your platform token, and the Vercel or Netlify project.
push decrypts on your machine and writes with your own platform token.

1. Link the folder and set your token

Vercel and Netlify read variables from their own settings. push copies one context there. Link the folder once with the platform's CLI, then set your token.

bash
vercel link export VERCEL_TOKEN=<token> netlify link export NETLIFY_AUTH_TOKEN=<token>

The token stays on your machine. getmyenv stores a push record only: names, a fingerprint and the destination. push needs an account. A guest project is refused until you claim it.

2. Dry run

npx getmyenv push vercel -c production --dry-run

  + STRIPE_SECRET_KEY      sensitive
  ~ DATABASE_URL           sensitive
  + NEXT_PUBLIC_API_URL    readable

+ adds a name, ~ updates one. Names and types only, nothing is written. It also says whether the context changed since the last push to that destination.

3. Push

bash
npx getmyenv push vercel -c production npx getmyenv push netlify -c production

The CLI decrypts on your machine and asks before it writes. Without a terminal, add --yes. That copy then lives in Vercel or Netlify. Changes in getmyenv are not pushed on their own, so run push again. The platform uses new values on its next deploy.

Production is Read-only. push reads it like run: with a server token in GETMYENV_TOKEN, from an IP on its allowlist, on a trusted or approved machine. Only the owner sets Read-only values, in the dashboard.

4. Readable, sensitive and public prefixes

  • Names with a public prefix, like NEXT_PUBLIC_ or VITE_, go up as readable. The build inlines them into the browser bundle, so anyone can read them.
  • Every other name goes up as Sensitive on Vercel, or secret on Netlify. The platform does not show the value again.
  • A public prefix on a value that looks secret prints a warning. Nothing is blocked.
  • If Vercel refuses Sensitive for Development, or Netlify refuses secret values for the account, those names go up as readable and are listed after the push. Netlify dev values are always readable.

5. Targets and prune

bash
npx getmyenv push vercel -c staging --target preview npx getmyenv push netlify -c production --prune --dry-run
  • Vercel targets: production (default), preview, development. Netlify: production (default), deploy-preview, branch-deploy, dev.
  • --prune also removes names from that target that are not in the context, and lists each one before it asks. Other targets keep theirs.
  • Left alone: names the platform reserves, like VERCEL_* and NETLIFY_*, Vercel Preview values for one branch, and Netlify variables with one value for all deploy contexts.

Related docs: Vercel and Netlify, Contexts, Machine access