Identify which values must remain private and whether the deployment runs a server or consists of static output. Review the configuration keys declared by the application.

1. Declare the expected keys in runtimeConfig. Put only deliberately public values in runtimeConfig.public.

2. Supply runtime overrides through the matching Nuxt environment variable names, such as the documented NUXT_ naming pattern. Confirm nested public keys use their corresponding public-prefixed form.

3. Read private values only from server-side code. A server endpoint can use a private credential to perform an authorised operation without sending the credential to the browser.

4. Review data returned by that endpoint. Keeping a key server-side does not help if the response exposes confidential provider data or permits unrestricted actions.

5. Test the actual production runtime and build mode. Static output cannot gain a new private server operation merely from adding an environment variable after publication.

Declare both values in the existing Nuxt configuration, but put only the deliberately public endpoint under public. The private token begins empty and should be supplied through protected production runtime configuration.

export default defineNuxtConfig({
  runtimeConfig: {
    catalogueToken: '',
    public: {
      apiBase: 'https://api.example.com',
    },
  },
});

Use NUXT_CATALOGUE_TOKEN for the private override and NUXT_PUBLIC_API_BASE for the public one. Read the token only in server code and reject the protected operation if it is missing. Production runtime values belong in the deployment environment; do not assume a development .env file is automatically loaded by the running server.

Expected result: Browser payloads contain the public base address but no token. A static-only deployment still needs an actual backend for private provider operations; adding an environment variable cannot create that server capability.

Inspect the browser payload and requests for accidental secret exposure. Confirm a controlled server-side operation uses the intended runtime value.

An unchanged value can indicate a mismatched environment variable name, undeclared key or build-time value baked into static output. Check the configuration mechanism before renaming variables at random.

• Deploying a Nuxt Node server build
• Publishing a prerendered Nuxt website
• Keeping browser bundles free of private API credentials
• Deploying a Vite site under a subdirectory

• Nuxt runtime configuration
• Nuxt configuration overview