Public DocsRoute-backed sectionsUpdated July 24, 2026

Clivly docs that match the product you ship today

Install the CLI, scaffold your routes, and connect your database to Clivly. Every step below is its own page, so you can deep-link straight to the one you need.

Start with QuickstartCLI Reference
What Changed In This Refresh
The previous page was accurate in parts, but it no longer mirrored the current integration path closely enough.

Lead with `clivly@next`, not the older stable line.

Added `create-clivly`, `connect()`, `doctor()`, and `cursorStore` guidance.

Separated framework recipes from widget and auth setup.

Kept better-auth, remote sync, and serverless guidance current.

Configurationkeys-and-environment

Keys & Environment

Understand the two-key model, keep the secret key server-side, and configure the sync trigger the cloud uses to reach your app.

`CLIVLY_SECRET_KEY``CLIVLY_PUBLISHABLE_KEY`Trigger secret
Secret key vs publishable key
Clivly issues two keys and they are not interchangeable. Getting this wrong is the one mistake with a security cost rather than a debugging cost.
.env
# Server-only. Never ships to the browser.
CLIVLY_SECRET_KEY=sk_live_...

# Safe to expose. Identifies the org to the chat widget.
CLIVLY_PUBLISHABLE_KEY=pk_live_...

# Set by `clivly login`, or copied from the dashboard Connect dialog.
CLIVLY_SYNC_TRIGGER_SECRET=...
CLIVLY_SYNC_TRIGGER_URL=https://your-app.example.com/api/clivly/tick
  • `CLIVLY_SECRET_KEY` authenticates your server to Clivly. It must never reach the browser, a client bundle, or a `VITE_`/`NEXT_PUBLIC_` variable.
  • `CLIVLY_PUBLISHABLE_KEY` identifies your org to the chat widget. It is designed to be public and is safe in client code.
  • `CLIVLY_API_KEY` is the former name of the secret key. It is still read as a fallback, but new setups should use `CLIVLY_SECRET_KEY`.
  • The dashboard Connect dialog emits both keys, already filled in — that is the shortest path to a working `.env`.
Sync trigger secret and URL
The sync trigger is how Clivly Cloud reaches your app. Your app is never dialled into directly — the cloud posts to a route you own.
  • `CLIVLY_SYNC_TRIGGER_SECRET` signs the cloud's requests to your tick route. With it set, unsigned requests are rejected with 401.
  • Without a secret the route stays open to anyone who can reach it — always set one if the route is publicly routable.
  • `CLIVLY_SYNC_TRIGGER_URL` tells the cloud where the route lives. The SDK also self-reports this on each heartbeat, deriving it from your platform's env (Vercel, Cloudflare Pages, Railway, Render, Fly).
  • Rotating the secret requires redeploying the host — remote sync fails until both sides match.
Previous
CLI
Open Section
Next
Framework Guides
Open Section