Environment Variables Now Use Config and Secret Types

Vercel has changed the process for adding and modifying environment variables to require selecting one of two types, Config or Secret, instead of using the previous 'Sensitive' toggle. Config allows members with access permissions to view the value even after saving, making it suitable for non-sensitive values with public framework prefixes, while Secret is used for deployments but prevents members from viewing the value, making it recommended for passwords and API keys.

Variables previously set as Sensitive are automatically treated as Secret and continue to function without migration. With this update, the 'Enforce Sensitive Environment Variables' team policy is deprecated, and a new security policy called Separate Production Secret Values is introduced. When this policy is enabled, Secret values in the Production environment must differ from those in other environments such as Preview and Development.

In the CLI, you can specify the variable type using the --visibility config or --visibility secret flags. The existing --sensitive flag is retained for compatibility but functions by mapping to either Config or Secret.