I came across similar problem, it is because since the process.env is only accessible on the server side the client sdk can not get access to those variables, its better to leave the firebase config as it is and control who/what domains can read/write on your database from the console.