Environment variables

Setting, reading, and rotating environment variables. Per-environment scoping.

Two kinds of env vars:

Public (VITE_*)

Visible to client code. For non-secret values: API base URLs, public keys (Stripe publishable, PostHog public).

Server-only

Available only in Convex actions and the build pipeline. For secrets: API keys, webhook signing secrets, service tokens.

Setting

Dashboard

Settings → Environments → [env] → Variables → Add.

CLI

vly env set RESEND_API_KEY re_... --env production
vly env set VITE_PUBLIC_KEY pk_... --env production

API

POST /v1/projects/{id}/env — see API reference.

Reading

In Convex code:

process.env.RESEND_API_KEY   // server-only
import.meta.env.VITE_PUBLIC_KEY   // client-visible

Rotation

For a single secret:

1. Get a new value from the provider

   e.g., generate a new Stripe API key.

2. Add the new value alongside the old

   Use a temp name like STRIPE_SECRET_KEY_NEW.

3. Deploy code that reads the new value

   Either rename or use a fallback pattern.

4. Revoke the old value

   At the provider.

5. Remove the old name

   Cleanup.

For atomic rotation (no overlap), use a brief downtime window during low traffic.

Common variables

Variable	Purpose
STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET	Stripe
RESEND_API_KEY	Resend email
OPENAI_API_KEY	OpenAI
ANTHROPIC_API_KEY	Anthropic
GITHUB_WEBHOOK_SECRET	GitHub webhook verification
APP_URL	The app’s base URL (used for OAuth redirects, email links)

Related

Secrets

Secret-store mechanics.

Secrets management

Best practices.

Environments

Per-env scoping.