Environment variables

Only PUBLIC_-prefixed env reaches the client. Read secrets from the server's env.

Vantage’s default is to never leak environment variables to the client. The boundary is the prefix.

Only PUBLIC_ reaches the client

Only variables beginning with PUBLIC_ are included in the client bundle and readable via import.meta.env.

// client code
const analyticsId = import.meta.env.PUBLIC_ANALYTICS_ID;

The client can only see:

• PUBLIC_* (the public values you define)
• MODE / DEV / PROD / SSR / BASE_URL (Vite standard)

Secrets come from the server’s env

Read secrets like API keys and tokens from the server’s ApiContext.env — never expose them to the client. These carry no prefix.

// server/api/report.ts
import type { ApiContext } from "@squadbase/vantage/server";

export async function GET({ env }: ApiContext) {
  const apiKey = env.SECRET_API_KEY; // never reaches the client
  // …call an external service
  return Response.json({ ok: true });
}

An .env example

# .env
PUBLIC_ANALYTICS_ID=UA-XXXX     # reaches the client
SECRET_API_KEY=sk_live_xxx      # server only (ApiContext.env)

Env used at deploy time

When you deploy the client and server on different origins, these env vars come into play.

See Build & deploy for how to use them.

What to read next

• Build & deploy — production env and split origins
• UI & theming — shape the look