env-management
Manage environment variables with split .env.client and .env.api structure. Use when adding new env vars, debugging config issues, or setting up environments.
When & Why to Use This Skill
This Claude skill streamlines environment variable management by implementing a secure, split-file structure (.env.client and .env.api). It ensures sensitive server-side secrets remain protected while public client-side variables are correctly prefixed, preventing security leaks and simplifying configuration across local development and cloud deployments like Cloudflare Pages.
Use Cases
- Scenario 1: Securely configuring a Next.js application by separating public browser-side variables from private server-side secrets to prevent accidental data exposure.
- Scenario 2: Auditing and debugging configuration issues by verifying variable prefixes and ensuring secrets like Stripe or Supabase service roles are not leaked to the client.
- Scenario 3: Streamlining developer onboarding by providing a standardized process for setting up local environments using .example templates.
- Scenario 4: Managing environment-specific variables for cloud deployment platforms, ensuring consistent behavior between local development and production environments.
| name | env-management |
|---|---|
| description | Manage environment variables with split .env.client and .env.api structure. Use when adding new env vars, debugging config issues, or setting up environments. |
Environment Variables
Split Structure
This project uses split env files (see docs/PRDs/env-system-refactor.md):
| File | Purpose | Prefix |
|---|---|---|
.env.client |
Public browser vars | NEXT_PUBLIC_* |
.env.api |
Server secrets | No prefix |
Adding New Variables
Client-side (Public)
- Add to
.env.client:NEXT_PUBLIC_API_URL=https://api.example.com - Access in code:
const url = process.env.NEXT_PUBLIC_API_URL;
Server-side (Secret)
- Add to
.env.api:STRIPE_SECRET_KEY=sk_live_xxx - Access only in server code:
// Only in app/api/*, server/*, or Server Components const key = process.env.STRIPE_SECRET_KEY;
Security Rules
- Never put secrets in
.env.client - Never prefix secrets with
NEXT_PUBLIC_ - Supabase anon key is public (safe for client)
- Supabase service role key is secret (API only)
Local Development
Copy example files:
cp .env.client.example .env.client
cp .env.api.example .env.api
Cloudflare Deployment
Set vars in Cloudflare Pages dashboard under Settings > Environment Variables.