Skills

Skill 15 of 33

Convex Env

Set and wire Convex deployment env vars / secrets for the app.

1 minute · 121 words · 3 sections

Install

$ npx skills add convex/agent-skills --skill convex-env

$ npx skills add convex/agent-skills

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

Manage env vars + secrets

Store secrets as Convex deployment env vars (npx convex env set), read them with process.env in actions, never commit them.

Workflow

npx convex env set KEY value (per deployment).
Read via process.env.KEY inside actions (not queries/mutations).
Never hardcode or commit secrets; add to .env.local only for local.
Confirm it’s set with npx convex env list --names-only, which lists names without printing the secret values.

Rules

Secrets live in Convex env vars, never in code or git.
process.env only in actions (‘use node’ if needed), not queries/mutations.
Different deployments need their own values.
Check what is set with npx convex env list --names-only; never print secret values into the conversation.

Colophon for this issue

Colophon

How this issue was made

Source

github.com/convex/agent-skills, branch main, last pushed 29 October 2026.

Licence

Apache-2.0 — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

33 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. One layout observed: skills/*/SKILL.md.

Issue colours

Resolved from a curated brand profile — hue 80°, chroma 0.160. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

1 repair applied to this skill so the document has one h1 and no skipped levels:

Shifted “3 headings” from h1 to h2 so the skill title is the only h1.

Spec compliance

Every skill satisfies the Agent Skills specification’s frontmatter rules.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /convex/agent-skills.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

Manage env vars + secrets

Store secrets as Convex deployment env vars (npx convex env set), read them with process.env in actions, never commit them.

npx convex env set KEY value (per deployment).

Read via process.env.KEY inside actions (not queries/mutations).

Never hardcode or commit secrets; add to .env.local only for local.

Confirm it’s set with npx convex env list --names-only, which lists names without printing the secret values.

Secrets live in Convex env vars, never in code or git.

process.env only in actions (‘use node’ if needed), not queries/mutations.

Different deployments need their own values.

Check what is set with npx convex env list --names-only; never print secret values into the conversation.