Platforms
Envlet on Vercel
One ENVLET_TOKEN in Vercel project settings. Your functions and server components inject the rest at boot.
ENVLET_TOKENset with vercel
Set up
Three steps. The host keeps one secret and everything else arrives at boot.
- 01
Create a token
Add Vercel under Access and create a token for the environment it deploys.
ci/vercelciIts own token, separate from your login.- token
- envlet_•••••••• shown once
- opens
- one project, one environment
- expires
- always
- 02
Set one secret
Add ENVLET_TOKEN in Vercel, one token per Vercel environment.
Set the tokenvercel env add ENVLET_TOKEN production - 03
Start through Envlet
Call inject() in instrumentation.ts (Next.js) or at the top of your server entry. Edge functions use load() and read the returned object.
Inject at bootimport { inject } from "@envlet/sdk"; export async function register() { await inject(); }
What the host keeps
One secret in Vercel. Rotate everything else in Envlet without touching the host.
Vercel / production / environment variables
| ENVLET_TOKEN | envlet_•••••••• | the only secret the host keeps |
| DATABASE_URL | •••••••• | moved to Envlet |
| STRIPE_KEY | •••••••• | moved to Envlet |
| SENTRY_DSN | •••••••• | moved to Envlet |
Questions
Will my app start if Envlet is down?
No. It retries for a few seconds, then fails so you notice. It never starts with half an environment.
Do I still need Vercel's own secret store?
Only for ENVLET_TOKEN. Everything else lives in Envlet, so you rotate in one place.