Hey folks,
Vercel recently replaced its Sensitive toggle with per-variable Config and Secret types. Config variables can be viewed in your Vercel dashboard. Secret variables stay available to your deployments and can be replaced, but can’t be viewed or retrieved after saving.
Vercel also now requires keys with a public framework prefix (e.g. NEXT_PUBLIC_) to be Config variables. Previously, a sync stored every secret as the same type, so a Secret sync that included one of those keys would fail and get disabled.
To solve for this, here’s what we’ve changed in Doppler:
- New naming: Vercel sync variable types are now Config and Secret (previously Encrypted and Sensitive) to match Vercel. Existing syncs keep working with no action required.
- New Dynamic type:
Dynamicsets the Vercel type per secret based on its visibility in Doppler. Unmasked secrets sync as Config, and masked or restricted secrets sync as Secret. - Visibility changes handled automatically: If a secret changes to unmasked, we delete and recreate it in Vercel, since Vercel doesn’t allow changing a Secret variable’s type in place.
- Clearer errors. If Vercel rejects a secret, the error now names the key and points you to the Dynamic option.
What to do: If you sync NEXT_PUBLIC_ (or similar) keys to Vercel alongside secrets that should stay hidden, re-create that sync as Dynamic and set the public keys to Unmasked in Doppler.
Docs: Vercel
Reach out here or support@doppler.com with any questions. Thanks!
