CtrlK
BlogDocsLog inGet started
Tessl Logo

env-setup

Create or update Novu environment variables in the user's project safely (never expose the secret key to the client). Complements the official Novu skills by covering project-level env configuration.

76

Quality

95%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Novu environment setup

Apply this skill exactly once per project, before installing client snippets.

Required variables

VariableWhere it livesPurpose
NOVU_SECRET_KEYServer onlyAuth for @novu/api, @novu/framework, MCP, CLI.
NEXT_PUBLIC_NOVU_APPLICATION_IDENTIFIER (Next.js) / VITE_NOVU_APPLICATION_IDENTIFIER (Vite) / REACT_APP_NOVU_APPLICATION_IDENTIFIER (CRA)ClientIdentifies the Novu application for the Inbox component.

Optional:

  • NOVU_API_URL=https://eu.api.novu.co for EU tenants.
  • NEXT_PUBLIC_NOVU_SUBSCRIBER_ID (only for static / demo apps that don't have a real auth provider — never use this in production).

Rules

  1. Never prefix NOVU_SECRET_KEY with NEXT_PUBLIC_*, VITE_*, or REACT_APP_*. Doing so leaks it into the client bundle.
  2. Add new variables to all of the project's env files: .env.local, .env.example, and (if present) deployment manifests like vercel.json, netlify.toml, or fly.toml.
  3. Update .gitignore to ensure .env.local is ignored.
  4. If the project uses @t3-oss/env-nextjs or similar typed env loaders, register the new keys in their schema.

Verification checklist

  • .env.example contains placeholder entries for every variable above.
  • .env.local (or platform-specific equivalent) has real values.
  • No console.log or telemetry call prints the secret key.
  • Secret key does not appear in any file under public/, src/components/, or any client bundle entrypoint.
Repository
novuhq/novu
Path

packages/novu/src/commands/wizard/skills/content/env-setup/SKILL.md

Commit

d921755

Last updated
First committed

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.

Claim skill