env

# Manage env vars + secrets Store secrets as Convex deployment env vars (npx convex env set), read them with process.env in actions, never commit them. ## Steps 1. `npx convex env set KEY value` (per deployment). 2. Read via process.env.KEY inside actions (not queries/mutations). 3. Never hardcode or commit secrets; add to .env.local only for local. 4. Confirm it's set with `npx convex env list --names-only`, which lists names without printing the secret values. ## Rules - Secrets live in Convex env vars, never in code or git. - process.env only in actions ('use node' if needed), not queries/mutations. - Different deployments need their own values. - Check what is set with `npx convex env list --names-only`; never print secret values into the conversation.