env-vars

To configure Vercel environment variables safely, use the `vercel env pull .env.local` CLI command to sync secrets locally, and avoid committing `.env.local` files to version control to prevent secret leakage in your Next.js application.

The correct Next.js environment variable load order prioritizes `.env.local` over `.env` to ensure local overrides take effect. Environment-specific files are loaded based on the active Vercel environment scope, preventing runtime configuration failures.

Your Vercel OIDC token expires because it is provisioned temporarily during local development. To refresh an expired `VERCEL_OIDC_TOKEN`, re-run the `vercel env pull` CLI command to provision a new token into your `.env.local` file.

You can use the Vercel CLI to manage environment variables by running `vercel env add` to create secrets, `vercel env ls` to list them, and `vercel env rm` to delete them across development, preview, and production scopes.

You should use `NEXT_PUBLIC_` environment variables in Next.js only when a value must be exposed to the browser. Exercise caution as a safety guardrail because incorrectly applying this prefix will publicly leak the secret value.

The best way to bootstrap a fresh development environment is to run `vercel env pull .env.local` via the Vercel CLI, then verify that every key listed in your `.env.example` file exists in the newly generated `.env.local` file.