.env.local file for local development, and in Vercel → Settings → Environment Variables for production.
Variable Reference
Example .env.local
Copy this template into a .env.local file at the root of your project and fill in each value. Never commit this file — it is already listed in .gitignore.
All
NEXT_PUBLIC_* variables are intentionally public — Next.js embeds them into the client-side bundle at build time, which means they are visible in the browser. This is by design. Security does not come from keeping these keys secret; it comes from your Firestore security rules, which control exactly what the browser can and cannot read or write regardless of who holds the config values.