Vercel

This guide will show you how to set up automatic syncing of Doppler secrets to Vercel.

Prerequisites

• You currently have a project on Vercel using environment variables for configuration

Authorize Doppler

Navigate to the project you would like to integrate, click Integrations from the Projects menu, then click Vercel to begin the authorization process.

You now then be redirected to authorize the Doppler application for Vercel. Click Authorize which will take you back to the Doppler dashboard.

Setup Integration

Vercel has three environments: Development, Preview (Staging), and Production, and a separate Vercel integration is required for each environment.

After authorizing Doppler for Vercel, you'll then be taken to the Setup Integration page to select the first config to sync for your project, selecting the:

• Team,
• Vercel project,
• Vercel environment,
• Vercel variable type, and
• Doppler config

Click Setup Integration and your secrets for that config will now be automatically synced to Vercel.

The final step is to set up integrations for the remaining Vercel environments by clicking New Integration and completing the configuration flow as done in the previous step, but for a different Vercel environment.

You can then confirm all Vercel environments have secrets syncing configured by clicking on the Vercel icon from the Integrations page:

You should see a Vercel integration for each environment:

Variable Types

Vercel stores each environment variable as either a Config variable, which can be viewed in the Vercel dashboard, or a Secret variable, which remains available to your deployments and can be replaced but cannot be viewed or retrieved after saving. Each sync has a variable type that determines how secrets are stored in Vercel:

• Config: Every secret is synced as a Config variable.
• Secret: Every secret is synced as a Secret variable.
• Dynamic: The Vercel variable type is based on each secret's visibility in Doppler. Unmasked secrets are synced as Config variables and masked or restricted secrets are synced as Secret variables. This is the default.

Vercel requires environment variables with a public framework prefix, such as NEXT_PUBLIC_, to be Config variables. If a sync attempts to store one of these variables as a Secret variable, Vercel rejects it and the sync is disabled with an error naming the variable. To sync these variables alongside secrets that should remain Secret variables, use the Dynamic variable type and set the visibility of the public variables to Unmasked in Doppler.

Reserved Environment Variables

The following Environment Variable cannot be used in configs synced to Vercel as they are reserved for use by the Vercel runtime:

• AWS_REGION
• AWS_DEFAULT_REGION
• AWS_ACCESS_KEY_ID
• AWS_SECRET_KEY
• AWS_SECRET_ACCESS_KEY
• AWS_EXECUTION_ENV
• AWS_LAMBDA_LOG_GROUP_NAME
• AWS_LAMBDA_LOG_STREAM_NAME
• AWS_LAMBDA_FUNCTION_NAME
• AWS_LAMBDA_FUNCTION_MEMORY_SIZE
• AWS_LAMBDA_FUNCTION_VERSION
• AWS_SESSION_TOKEN
• NOW_REGION
• TZ
• LAMBDA_TASK_ROOT
• LAMBDA_RUNTIME_DIR

👍

Amazing Work!

You have now configured Doppler to sync secrets for every Vercel environment.

Updating your Vercel sync to use Secret environment variables

Vercel recommends storing all secrets as Secret environment variables. Secret variables cannot be read back via the Vercel dashboard or API after being set.

If your sync was created before Vercel released Secret environment variable support, it may use the Config setting and must be recreated.

Steps

1. Navigate to the Integrations page in your Doppler workspace.
2. Under the Connections section, find your Vercel connection(s) and click on the project or ellipsis menu to view details.
3. For each sync, delete and recreate it one at a time:
   1. Click the ellipsis menu and select Delete. Important: When prompted, choose "Delete all secrets in Vercel" as well. This prevents existing Config variables from remaining in Vercel.
      1. Note: If your Vercel project is configured to auto-deploy on environment variable changes, deleting secrets may trigger a redeployment.
   2. Once deleted, recreate your sync and select "Secret" as the variable type.
4. After recreating each sync, verify in Vercel under Environment Variables that the Secret badge is displayed next to your synced variables.