Env files

API keys are passwords. Three places, only two of them allowed:

In the repo:

cp .env.example .env

Edit .env in a text editor. Put real keys on the right of the =. No quotes unless the value needs them. No spaces around =.

ANTHROPIC_API_KEY=sk-ant-your-real-key

Next.js only exposes keys to the browser if they start with NEXT_PUBLIC_. Do not prefix secret keys that way. Server-only keys stay unprefixed and are read in server code.

Restart pnpm dev after you change .env. Next does not pick up new keys hot.

Production

Vercel → your project → Settings → Environment Variables. Add the same names. Production and Preview are different slots. If Preview 500s and Production works, you only filled Production. Deploy again after adding variables. Existing deployments keep the old env.

Local .env does not upload. That is the point. Production only knows what you typed into Vercel.

Need a specific secret (Claude, OpenAI, Stripe, Coinbase, GitHub token)? Keys. Same ritual as this page, one dashboard at a time.

Next if the app must remember something: Data.