env-vars

name	env-vars
description	Environment variables management with .env files, t3-env validation with Zod, secrets handling, runtime config, and Next.js env exposure rules (NEXT_PUBLIC_*)
layer	utility
category	devops
triggers	["env vars","environment variables",".env","t3-env","NEXT_PUBLIC","secrets management","runtime config","env validation"]
inputs	["variable names","runtime context","framework","secret/public classification"]
outputs	["env schema",".env.example","validation setup","runtime config module"]
linksTo	["docker","cicd","vercel"]
linkedFrom	["bootstrap","ship","security-scanner"]
preferredNextSkills	["cicd","vercel"]
fallbackSkills	["docker","nextjs"]
riskLevel	low
memoryReadPolicy	selective
memoryWritePolicy	none
sideEffects	["May add @t3-oss/env-nextjs and zod dependencies","May create or modify .env files and .env.example"]

Environment Variables Skill

Purpose

Environment variables separate config from code. This skill ensures variables are validated at build time (not runtime surprises), secrets never leak to the client, and .env files are properly structured across environments.

Key Concepts

Next.js Env Exposure Rules

NEXT_PUBLIC_*  → Bundled into client JS, visible to anyone
All others     → Server-only, never sent to browser

Rule: If a variable contains a secret, it MUST NOT start with NEXT_PUBLIC_

t3-env Validation (Recommended)

// env.ts — single source of truth
import { createEnv } from "@t3-oss/env-nextjs";
import { z } from "zod";

export const env = createEnv({
  server: {
    DATABASE_URL: z.string().url(),
    JWT_SECRET: z.string().min(32),
    STRIPE_SECRET_KEY: z.string().startsWith("sk_"),
    REDIS_URL: z.string().url().optional(),
    NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
  },
  client: {
    NEXT_PUBLIC_APP_URL: z.string().url(),
    NEXT_PUBLIC_POSTHOG_KEY: z.string().().(),
  },
  : {
    : process..,
    : process..,
    : process..,
    : process..,
    : process..,
    : process..,
    : process..,
  },
  
  : !!process..,
});