Changed a Next.js environment variable but the browser still uses the old value?

Identify the value and the build

A product owner changes a public API address or non-sensitive feature setting in a host dashboard, but the released page still calls the old address. Record the served build revision and whether the code reads a NEXT_PUBLIC_ variable through a static property reference. Next.js can inline that value into client JavaScript at build time. Restarting the same built application does not rewrite that browser bundle.

• Compare an explicitly non-sensitive marker, never dump all environment values.
• Differentiate an old served build from a new build produced with the wrong setting.

Compare build input with runtime input

Inspect where the authorised build received configuration and which environment was selected. A single image promoted from preview to production can carry preview's frozen public values. Check the documented environment load order: an existing process value or more specific file can win over .env. Test mode intentionally ignores .env.local, so a passing local test is not proof the release received the intended value.

• Keep build and deployment identifiers with the configuration decision.
• Do not attach .env files, connection strings or provider keys to an enquiry.

Choose rebuild or designed runtime configuration

For a value meant to be fixed per build, rebuild through the authorised route with the correct non-sensitive input and inspect the resulting browser behaviour. If one image must serve multiple configurations, an explicit runtime delivery mechanism needs its own validation, caching and public-field allowlist. Adding NEXT_PUBLIC_ to a private database or provider secret is not a repair: it makes the value available to visitors.

• Keep private credentials server-side; do not use dynamic property lookup as an assumed public-variable replacement.
• If a secret was exposed, treat credential revocation and incident handling as a separate authorised task, not just removal of the visible text.

Acceptance checks the served client

Use a safe preview with a known public marker or destination to show that the expected build reaches the agreed endpoint and the server-only value is not included in the client output. Verify the intended promoted environment separately if in scope. This is configuration behaviour, not a claim that a production release or credential audit was completed. Send version, public symptom and build context initially; access, release approval and price remain separately agreed.