# Env Setup

> Env Setup is an Agent Skill for devops & security published in the novuhq/novu repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Create or update Novu environment variables in the user's project safely (never expose the secret key to the client). Complements the official Novu skills by covering project-level env configuration.

- Skill name: `env-setup`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/novuhq/novu/blob/HEAD/packages/novu/src/commands/wizard/skills/content/env-setup/SKILL.md
- Repository: novuhq/novu (39,326 GitHub stars when collected)

## SKILL.md

# Novu environment setup

Apply this skill exactly once per project, before installing client snippets.

## Required variables

| Variable | Where it lives | Purpose |
|---|---|---|
| `NOVU_SECRET_KEY` | Server only | Auth for `@novu/api`, `@novu/framework`, MCP, CLI. |
| `NEXT_PUBLIC_NOVU_APPLICATION_IDENTIFIER` (Next.js) / `VITE_NOVU_APPLICATION_IDENTIFIER` (Vite) / `REACT_APP_NOVU_APPLICATION_IDENTIFIER` (CRA) | Client | Identifies the Novu application for the Inbox component. |

Optional:

- `NOVU_API_URL=https://eu.api.novu.co` for EU tenants.
- `NEXT_PUBLIC_NOVU_SUBSCRIBER_ID` (only for static / demo apps that don't have a real auth provider — never use this in production).

## Rules

1. **Never** prefix `NOVU_SECRET_KEY` with `NEXT_PUBLIC_*`, `VITE_*`, or `REACT_APP_*`. Doing so leaks it into the client bundle.
2. Add new variables to all of the project's env files: `.env.local`, `.env.example`, and (if present) deployment manifests like `vercel.json`, `netlify.toml`, or `fly.toml`.
3. Update `.gitignore` to ensure `.env.local` is ignored.
4. If the project uses `@t3-oss/env-nextjs` or similar typed env loaders, register the new keys in their schema.

## Verification checklist

- [ ] `.env.example` contains placeholder entries for every variable above.
- [ ] `.env.local` (or platform-specific equivalent) has real values.
- [ ] No `console.log` or telemetry call prints the secret key.
- [ ] Secret key does not appear in any file under `public/`, `src/components/`, or any client bundle entrypoint.

---

Source: https://www.openparable.com/skill/devops-security/env-setup (OpenParable). Cite the canonical URL above.