DeployEnv varsVercel

Works locally, broken after deploy: env var missing in production

Error: Missing environment variable (works on localhost, fails on Vercel / Netlify / Cloudflare)

In short: .env files stay on your machine. Your host only knows the variables you add in its dashboard.

Why it happens

.env and .env.local are (correctly) git-ignored, so they never reach the server. The host builds your app without them. A second common cause is adding the variable for the Preview environment only, or adding it after the last build without redeploying.

How to fix it

  1. Open your host's project settings → Environment Variables and add each variable from .env.local by name.
  2. Pick the right environment(s): Production, Preview, Development. On Vercel these are separate checkboxes.
  3. Trigger a new deployment. Existing builds don't pick up new values.
  4. Check the build log for the variable being read. Print Boolean(process.env.MY_VAR) (never the value) from a server route to confirm it's present at runtime.
  5. If you use a framework prefix (NEXT_PUBLIC_, VITE_), the name on the host must include it.
Don't: Don't commit your .env file to make the deploy work. Bots scan public repos for keys within minutes.

Copy-paste fix prompt

Paste into Cursor, Claude Code, Codex, Lovable, Bolt, Replit or v0
I'm getting this error in my app:

Error: Missing environment variable (works on localhost, fails on Vercel / Netlify / Cloudflare)

[Paste the full error, stack trace, and the file it points to here]

Likely cause: .env files stay on your machine. Your host only knows the variables you add in its dashboard.

Task: Make a checklist of every environment variable the app needs in production, which environment (Production/Preview) each belongs in, and whether it's public or secret. Don't print secret values.

Rules:
- First explain the root cause in 2 sentences and list the files you'll change.
- Make the smallest change that fixes it. Don't refactor unrelated code.
- Don't disable security or checks (RLS, auth, signature verification, type checking, CORS allow-all) to make the error disappear.
- Never print or hard-code secret keys.
- Finish by telling me exactly how to verify the fix.

Common with: Cursor, Bolt, Lovable, Replit. Last reviewed 2026-11-13.

Related fixes

← All fixes · Still stuck? Use the diagnose-first prompt