Agent-Skills.md

Agent Skills: Novu environment setup

Create or update Novu environment variables in the user's project safely (never expose the secret key to the client). Complements the official Novu skills by covering project-level env configuration.

UncategorizedID: novuhq/novu/env-setup

Repository

novuhq/novu
novuhqLicense: NOASSERTION
40,1804,513

Install this agent skill to your local

pnpm dlx add-skill https://github.com/novuhq/novu/tree/HEAD/packages/novu/src/commands/wizard/skills/content/env-setup

Skill Files

Browse the full folder contents for env-setup.

Download Skill

Loading file tree…

packages/novu/src/commands/wizard/skills/content/env-setup/SKILL.md

Skill Metadata

Name
env-setup
Description
Create or update Novu environment variables in the user's project safely (never expose the secret key to the client). Complements the official Novu skills by covering project-level env configuration.

Novu environment setup

Apply this skill exactly once per project, before installing client snippets.

Required variables

| Variable | Where it lives | Purpose | |---|---|---| | NOVU_SECRET_KEY | Server only | Auth for @novu/api, @novu/framework, MCP, CLI. | | NEXT_PUBLIC_NOVU_APPLICATION_IDENTIFIER (Next.js) / VITE_NOVU_APPLICATION_IDENTIFIER (Vite) / REACT_APP_NOVU_APPLICATION_IDENTIFIER (CRA) | Client | Identifies the Novu application for the Inbox component. |

Optional:

  • NOVU_API_URL=https://eu.api.novu.co for EU tenants.
  • NEXT_PUBLIC_NOVU_SUBSCRIBER_ID (only for static / demo apps that don't have a real auth provider — never use this in production).

Rules

  1. Never prefix NOVU_SECRET_KEY with NEXT_PUBLIC_*, VITE_*, or REACT_APP_*. Doing so leaks it into the client bundle.
  2. Add new variables to all of the project's env files: .env.local, .env.example, and (if present) deployment manifests like vercel.json, netlify.toml, or fly.toml.
  3. Update .gitignore to ensure .env.local is ignored.
  4. If the project uses @t3-oss/env-nextjs or similar typed env loaders, register the new keys in their schema.

Verification checklist

  • [ ] .env.example contains placeholder entries for every variable above.
  • [ ] .env.local (or platform-specific equivalent) has real values.
  • [ ] No console.log or telemetry call prints the secret key.
  • [ ] Secret key does not appear in any file under public/, src/components/, or any client bundle entrypoint.