Vercel Makes Config and Secret types Explicit for Environment Variables.

Vercel is giving environment variables clearer security labels. When developers add or edit a variable, they must now classify it as either Config or Secret, replacing the platform’s previous Sensitive toggle.

The change, detailed in an official changelog entry published on August 24, 2026, is primarily about making the consequences of that choice easier to understand. Config values remain readable by authorized project members after they are saved. Secret values remain available to deployments, but cannot be viewed or retrieved by members after saving.

That distinction matters because environment variable dashboards often contain a mixture of ordinary application settings and high-risk credentials. A public framework variable, regional setting, or feature flag may need to be inspected during troubleshooting. An API key, password, or authentication token generally should not remain visible once entered.

The updated interface presents the two categories directly when a variable is created or edited:

• Config: Intended for non-sensitive values that team members may need to inspect later. Vercel specifically points to variables using public framework prefixes as an example.
• Secret: Intended for passwords, API keys, tokens, and other credentials. The value can be replaced and remains usable by deployments, but cannot be displayed or retrieved after it has been saved.

The practical improvement is less about adding another control and more about replacing an ambiguous one. Under the earlier model, users added a variable and separately decided whether to enable a Sensitive toggle. The new labels describe both the intended use and the resulting visibility behavior before the value is saved.

For small teams, that could reduce common configuration mistakes. A developer setting up an integration can identify a token as a Secret without needing to interpret what “Sensitive” changes inside the dashboard. Meanwhile, values that legitimately need to remain accessible can be classified as Config rather than being hidden unnecessarily.

Vercel says no migration is required. Any existing environment variable previously marked Sensitive is automatically treated as a Secret and continues working with deployments.

That compatibility is important for production projects because changing the interface does not require teams to re-enter credentials or modify application code. Variables retain their role in the deployment environment; the update changes how they are categorized and handled in Vercel’s project interface.

Teams may still want to audit older variables. Values that were never marked Sensitive will not automatically become Secrets simply because they resemble credentials. Reviewing API keys, database passwords, webhook signing secrets, and third-party tokens would help ensure that the new classification matches the actual sensitivity of each value.

The announcement does not describe a new encryption system or broader secrets-management product. It focuses on type-specific visibility and handling within Vercel projects. Developers also remain responsible for how variables are used in application code. A credential classified as Secret can still be exposed if code deliberately includes it in a browser bundle or public response.

For builders without dedicated platform or security teams, the revised terminology provides a more direct decision at setup time: should collaborators be able to read this value later, or should deployments use it without revealing it again? That is a small interface change, but one with useful operational consequences when a project accumulates dozens of variables across integrations and environments.

What is Vercel Config and Secret types?

Config and Secret types are Vercel’s new classifications for environment variables. Config values remain readable to project members with access, while Secret values can be used by deployments but cannot be viewed or retrieved after saving.

What happens to existing Sensitive environment variables?

Existing variables marked Sensitive are automatically treated as Secrets. Vercel says they continue to work without migration, re-entry, or application code changes.

When should a variable be classified as a Secret?

Vercel recommends using Secret for passwords, API keys, and tokens. Non-sensitive settings that authorized members may need to inspect later, including variables with public framework prefixes, are better suited to Config.