# Environment variables now use Config and Secret types

**Published:** August 24, 2026 | **Authors:** Brooke Mosby | **Contributors:** Amelia Charles

---

When you add or edit an environment variable in Vercel, you now choose Config or Secret instead of using the Sensitive toggle. Existing variables marked Sensitive are automatically treated as Secrets and continue to work without migration.

- **Config:** The value remains readable after saving for members with access. Use Config for non-sensitive values you may need to inspect later, such as variables with a public framework prefix.
- **Secret: **The value remains available to your deployments and can be replaced, but members cannot view or retrieve it after saving. Use Secret for passwords, API keys, and tokens.

![The Add Environment Variable form, with Secret selected as the type.](//images.ctfassets.net/e5382hct74si/5LUS92qt7R7adaG9JpVidO/463001065b366cd88da7b1022808d697/web-light-nopadding.png)
*The Add Environment Variable form, with Secret selected as the type.*

You can select an environment or Preview branch for each value. The [environment variable list](https://vercel.com/d?to=%2F%5Bteam%5D%2F%5Bproject%5D%2Fsettings%2Fenvironment-variables&title=Go+to+Environment+Variables) in the dashboard shows each variable’s type and where it applies.

### Team policy changes

The **Enforce Sensitive Environment Variables** team policy is deprecated with this update. When enabled, it required every environment variable created by a team member to be Sensitive, including non-sensitive configuration. With Config and Secret types, members can choose the appropriate type for each variable.

A new **Separate Production Secret Values** policy is available in your [Security settings](https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fsettings%2Fsecurity&title=Go+to+Security+settings). When enabled, the Production value for a Secret must differ from the values used for the same key in Preview, Development, and custom environments.

![The new Separate Production Secret Values policy in your team's Security settings.](//images.ctfassets.net/e5382hct74si/tcWxTkuiOQJTICMKLZqNh/00abb5d74f04a362c6e4786383dc24c1/policy-web-light-nopadding.png)
*The new Separate Production Secret Values policy in your team's Security settings.*

If your team had the legacy policy enabled, confirm whether the Separate Production Secret Values policy should be enabled for your team. The deprecated policy is no longer enforced by the Vercel CLI.

### Set variable types from the CLI

To choose whether an environment variable is a Config or Secret from the CLI, pass `--visibility config` or `--visibility secret` to `vercel env add` or `vercel env update`:

```bash
# Config
vercel env add API_URL production --value "https://api.example.com" --visibility config --yes

# Secret
vercel env add API_KEY production --value "sk_live_..." --visibility secret --yes
```

The existing flags continue to work. When `--visibility` is omitted, `--no-sensitive` maps to Config and `--sensitive` maps to Secret. After adding or updating a variable, the CLI output shows its type under `Visibility`.

Learn more in the [Environment Variables documentation](https://vercel.com/docs/environment-variables).

---

📚 **More updates:** [View all changelog entries](/changelog/sitemap.md) | [Blog](/blog/sitemap.md)