Next.js inlines environment variables at build time with specific rules for client exposure. Misconfiguring secrets is a common production incident.
Common Interview Questions
Q: NEXT_PUBLIC_ prefix?
Answer: Variables prefixed with NEXT_PUBLIC_ are embedded in the client bundle and visible to browsers. Never put API secrets there.
Q: Server-only variables?
Answer: Unprefixed vars are available only in Node server context — Server Components, route handlers, middleware (limited).
const apiKey = process.env.DATABASE_URL; // server only
Q: .env file precedence?
Answer: .env.local overrides .env. .env.development / .env.production apply per NODE_ENV. .env.local should be gitignored.
Q: Runtime env on Vercel?
Answer: Build-time inlining means changing env requires rebuild unless using runtime config patterns or edge config for dynamic values.
Key Points for Interviews
-
PUBLIC prefix = client visible
-
Secrets stay unprefixed server-side
-
Validate required env at startup
-
Use zod env schema in production apps
-
Never commit .env.local with secrets