# Environment variables now use Config and Secret types

DevFeed: [Environment variables now use Config and Secret types](<https://devfeed.tech/articles/environment-variables-now-use-config-and-secret-types-917.md>)

Original publisher: [Read original article](<https://vercel.com/changelog/environment-variables-now-use-config-and-secret-types>)

Author: Brooke Mosby

Published: 2026-08-24T00:00:00Z

Content type: release

Language: en

Sources: [Vercel News](<https://devfeed.tech/sources/vercel-news.md>)

Topics: [configuration](<https://devfeed.tech/topics/configuration.md>), [Vercel](<https://devfeed.tech/topics/vercel.md>), [Security](<https://devfeed.tech/topics/security.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [API keys](<https://devfeed.tech/topics/api-keys.md>), [passwords](<https://devfeed.tech/topics/passwords.md>)

Tags: [config](<https://devfeed.tech/tags/config.md>), [development](<https://devfeed.tech/tags/development.md>), [documentation](<https://devfeed.tech/tags/documentation.md>), [passwords](<https://devfeed.tech/tags/passwords.md>), [policy](<https://devfeed.tech/tags/policy.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [tokens](<https://devfeed.tech/tags/tokens.md>), [vercel](<https://devfeed.tech/tags/vercel.md>)

## AI overview

Vercel now uses Config and Secret types for environment variables instead of the Sensitive toggle. Config values remain readable to authorized members, while Secret values remain available to deployments but cannot be viewed or retrieved after saving. The update also introduces a policy for separating Production secret values and adds CLI support through visibility settings.

## Source excerpt

When you add or edit an environment variable in Vercel, you now choose Config or Secret instead of using the Sensitive toggle. Existing variables marked Sensitive are automatically treated as Secrets and continue to work without migration. Config: The value remains readable after saving for members with access. Use Config for non-sensitive values you may need to inspect later, such as variables with a public framework prefix. Secret: The value remains available to your deployments and can be replaced, but members cannot view or retrieve it after saving. Use Secret for passwords, API keys, and tokens. You can select an environment or Preview branch for each value. The environment variable list in the dashboard shows each variable's type and where it applies. Team policy changes The Enforce Sensitive Environment Variables team policy is deprecated with this update. When enabled, it required every environment variable created by a team member to be Sensitive, including non-sensitive configuration. With Config and Secret types, members can choose the appropriate type for each variable. A new Separate Production Secret Values policy is available in your Security settings. When enabled, the Production value for a Secret must differ from the values used for the same key in Preview, Development, and custom environments. If your team had the legacy policy enabled, confirm whether the Separate Production Secret Values policy should be enabled for your team. The deprecated policy is no longer enforced by the Vercel CLI. Set variable types from the CLI To choose whether an environment variable is a Config or Secret from the CLI, pass --visibility config or --visibility secret to vercel env add or vercel env update: The existing flags continue to work. When --visibility is omitted, --no-sensitive maps to Config and --sensitive maps to Secret. After adding or updating a variable, the CLI output shows its type under Visibility. Learn more in the Environment Variables documentation