By name: env-setup description: Create or update Novu environment variables in the user's project safely (never expose the secret key to the client). Complements the official Novu skills by covering project-level env configuration. triggers: - configure novu env vars - add novu keys to .env - secret key handling
Novu environment setup
Apply this skill exactly once per project, before installing client snippets.
Required variables
| Variable | Where it lives | Purpose |
|---|---|---|
NOVU_SECRET_KEY |
Server only | Auth for @novu/api, @novu/framework, MCP, CLI. |
NEXT_PUBLIC_NOVU_APPLICATION_IDENTIFIER (Next.js) / VITE_NOVU_APPLICATION_IDENTIFIER (Vite) / REACT_APP_NOVU_APPLICATION_IDENTIFIER (CRA) |
Client | Identifies the Novu application for the Inbox component. |
Optional:
NOVU_API_URL=https://eu.api.novu.cofor EU tenants.NEXT_PUBLIC_NOVU_SUBSCRIBER_ID(only for static / demo apps that don't have a real auth provider — never use this in production).
Rules
- Never prefix
NOVU_SECRET_KEYwithNEXT_PUBLIC_*,VITE_*, orREACT_APP_*. Doing so leaks it into the client bundle. - Add new variables to all of the project's env files:
.env.local,.env.example, and (if present) deployment manifests likevercel.json,netlify.toml, orfly.toml. - Update
.gitignoreto ensure.env.localis ignored. - If the project uses
@t3-oss/env-nextjsor similar typed env loaders, register the new keys in their schema.
Verification checklist
-
.env.examplecontains placeholder entries for every variable above. -
.env.local(or platform-specific equivalent) has real values. - No
console.logor telemetry call prints the secret key. - Secret key does not appear in any file under
public/,src/components/, or any client bundle entrypoint.