`AUTH_SECRET` Env Variable Not Accessible in Production Runtime

Help
1

I am experiencing a critical issue where my Next.js application is unable to access the AUTH_SECRET environment variable in production,
which prevents Auth.js (NextAuth.js) from working.

Problem:
The application consistently fails with a [auth][error] MissingSecret error on every request that involves authentication. This happens
in both the Edge Middleware and in Lambda function API routes, preventing any user sign-ins.

Troubleshooting Steps Already Taken:
We have exhaustively troubleshooted this and can confirm the following:

  1. The AUTH_SECRET and AUTH_URL environment variables are correctly set in the Vercel project settings for the Production, Preview, and
    Development environments.
  2. We have verified there are no typos and have redeployed the application multiple times after each configuration change.
  3. We added diagnostic logging (console.log(process.env.AUTH_SECRET)) to the application, and the Vercel logs confirmed the variable is
    undefined at runtime.
  4. The code follows standard Auth.js patterns, including export { auth as middleware } from “@/auth” in src/middleware.ts.
  5. We attempted workarounds like setting trustHost: true and explicitly passing the variables via next.config.js, none of which resolved
    the underlying issue of the secret being unavailable.

The evidence strongly suggests that the environment variables, despite being set in the UI, are not being correctly injected into my
application’s runtime environment.

Could you please investigate why my project’s environment variables are not being exposed to the running application?

Thank you.

3

We don’t have any active incidents around environment variables so I don’t suspect Vercel has stopped passing them to application servers (as this would cause instant downtime for almost every customer)

Other scenarios that could lead them to being undefined:

  • Logging on the client, as Next.js only passes down environment variables to the client if they’re prefixed with NEXT_PUBLIC. This isn’t what you want for auth secrets though, so that one is unlikely
  • If you are upgrading to Auth.js from NextAuth, you may still have the old NEXTAUTH_SECRET and NEXTAUTH_URL variables set, which were renamed to AUTH_ along with the package

Is this a new project that is failing or is this something that has worked historically for you until recently?