OpenParable
Skip to content
← Back to skills

Env Setup

DevOps & Security
env-setup

Env Setup is an Agent Skill for devops & security published in the novuhq/novu repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Create or update Novu environment variables in the user's project safely (never expose the secret key to the client). Complements the official Novu skills by covering project-level env configuration.

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/novuhq/novu/blob/HEAD/packages/novu/src/commands/wizard/skills/content/env-setup/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/env-setup, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Novu environment setup

Apply this skill exactly once per project, before installing client snippets.

Required variables

VariableWhere it livesPurpose
NOVU_SECRET_KEYServer onlyAuth for @novu/api, @novu/framework, MCP, CLI.
NEXT_PUBLIC_NOVU_APPLICATION_IDENTIFIER (Next.js) / VITE_NOVU_APPLICATION_IDENTIFIER (Vite) / REACT_APP_NOVU_APPLICATION_IDENTIFIER (CRA)ClientIdentifies the Novu application for the Inbox component.

Optional:

  • NOVU_API_URL=https://eu.api.novu.co for EU tenants.
  • NEXT_PUBLIC_NOVU_SUBSCRIBER_ID (only for static / demo apps that don't have a real auth provider — never use this in production).

Rules

  1. Never prefix NOVU_SECRET_KEY with NEXT_PUBLIC_*, VITE_*, or REACT_APP_*. Doing so leaks it into the client bundle.
  2. Add new variables to all of the project's env files: .env.local, .env.example, and (if present) deployment manifests like vercel.json, netlify.toml, or fly.toml.
  3. Update .gitignore to ensure .env.local is ignored.
  4. If the project uses @t3-oss/env-nextjs or similar typed env loaders, register the new keys in their schema.

Verification checklist

  • .env.example contains placeholder entries for every variable above.
  • .env.local (or platform-specific equivalent) has real values.
  • No console.log or telemetry call prints the secret key.
  • Secret key does not appear in any file under public/, src/components/, or any client bundle entrypoint.