Only environment variables prefixed with NEXT_PUBLIC_ are exposed to the browser. Others stay server only.

Next.js inlines a variable into the client bundle only when its name starts with NEXT_PUBLIC_. A variable without that prefix is available on the server but never shipped to the browser. Reading a non prefixed variable in a Client Component returns undefined. This is how a secret key stays out of client code.