LeakPatrol

LeakPatrol › Guides

Are VITE_ environment variables secret?

By LeakPatrol · Updated 23 October 2026

No. In a Vite app, every environment variable that starts with VITE_ is written into the JavaScript bundle at build time, and that bundle is downloaded by every visitor. The same goes for NEXT_PUBLIC_ in Next.js and REACT_APP_ in Create React App. If an API key is in one of those variables, it is public.

Why the prefix exists

Vite deliberately hides variables without the VITE_ prefix from your frontend code. The prefix is how you tell Vite "this value is safe to publish". AI coding tools often add it to make an error go away (import.meta.env.OPENAI_API_KEY is undefined, so they rename it to VITE_OPENAI_API_KEY), which is exactly how secret keys leak.

What's fine in a VITE_ variable

What must never be in one

Not sure which kind you have? Paste it into our free key checker, which runs in your browser.

How to hide an API key in a Vite or React app

  1. Move the call to a server. Create a Supabase Edge Function, a Netlify or Vercel function, or an API route that calls the provider.
  2. Store the key as a server secret (for example supabase secrets set OPENAI_API_KEY=…), with no VITE_ prefix.
  3. Call your function from the frontend instead of the provider. Check the user is logged in inside the function, so strangers can't use it as a free proxy.
  4. Rotate the old key. It's in every copy of your old bundle, including caches.

A prompt that works in Lovable, Bolt or Cursor: "Move every call that uses a secret API key out of the frontend into a Supabase Edge Function that reads the key from Supabase secrets. Remove the VITE_ variable for it and call the function instead. Only allow logged-in users to call it."

Check what your live site exposes

Your .env file isn't the only place to look: what matters is what ended up in the built JavaScript. The free LeakPatrol scan reads every script your live site loads and lists any secret keys it finds (masked), plus public .env files and source maps.

Check your app in a minute

Free, read-only, no sign-up. Every problem comes with a plain-English fix and a prompt for your AI tool.

Get the 10-point checklist

Every check we run on AI-built apps, with how to do each one yourself. Straight to your inbox.

Questions

Are VITE_ environment variables secret?

No. Vite bundles every VITE_ variable into the frontend JavaScript, which every visitor downloads. Only public values such as a Supabase anon key or Stripe publishable key belong there.

How do I hide an API key in a Vite app?

Move the API call into a server-side function (Supabase Edge Function, Netlify or Vercel function, or API route), store the key as a server secret without the VITE_ prefix, and call your function from the frontend.

Is import.meta.env safe for API keys?

Only for public values. import.meta.env.VITE_ values are replaced with the real value at build time and shipped to the browser.

Is it safe to put the Supabase anon key in a VITE_ variable?

Yes, the anon key is designed to be public, as long as Row Level Security is enabled on every table with proper policies.

More guides