Reference
Environment variables
Every Clivly environment variable, what it does, and where it is set.
For the conceptual model — why the keys and the trigger URL are fundamentally different things — see Keys.
Keys
# Server-only. Never ships to the browser.
CLIVLY_SECRET_KEY=sk_live_...
# Safe to expose. Identifies the org to the chat widget.
CLIVLY_PUBLISHABLE_KEY=pk_live_...
# Set by `clivly login`, or copied from the dashboard Connect dialog.
CLIVLY_SYNC_TRIGGER_SECRET=...
CLIVLY_SYNC_TRIGGER_URL=https://your-app.example.com/api/clivly/tick| Variable | Required | Notes |
|---|---|---|
CLIVLY_SECRET_KEY | Yes | Authenticates your server to Clivly. Must never reach the browser, a client bundle, or a VITE_/NEXT_PUBLIC_ variable. |
CLIVLY_API_KEY | No | The former name of the secret key. Still read as a fallback, but new setups should use CLIVLY_SECRET_KEY. |
CLIVLY_PUBLISHABLE_KEY | Only for the chat widget | Identifies your org to the chat widget. Designed to be public and safe in client code. |
CLIVLY_SYNC_TRIGGER_SECRET | Recommended | Signs the cloud's requests to your tick route. With it set, unsigned requests are rejected with 401. Without a secret the route stays open to anyone who can reach it — always set one if the route is publicly routable. |
CLIVLY_SYNC_TRIGGER_URL | Usually automatic | Tells the cloud where your tick route lives. The SDK also self-reports this on each heartbeat, deriving it from your platform's env (Vercel, Cloudflare Pages, Railway, Render, Fly). |
- The dashboard Connect dialog emits both keys, already filled in — that is the shortest path to a working
.env. - Rotating the secret requires redeploying the host — remote sync fails until both sides match.
The sync trigger is how Clivly Cloud reaches your app. Your app is never dialled into directly — the cloud posts to a route you own.
CLIVLY_SYNC_TRIGGER_SECRET
Proves the caller is really Clivly. Your route rejects anything unsigned.
CLIVLY_SYNC_TRIGGER_URL
Where Clivly sends that request. Usually discovered for you after deploy.
Both describe the same inbound call — one authenticates it, the other routes it.
Sync trigger URL by environment
# Public URL of your tick route — replace <yourDomain.com> once deployed.
# Local dev: run `clivly dev` instead.
CLIVLY_SYNC_TRIGGER_URL=https://<yourDomain.com>/api/clivly/tickclivly login writes this visible template rather than an empty line. The angle brackets are load-bearing — while they are there the SDK treats the line as unset, so an unedited placeholder never becomes a real, and broken, address.
See How Clivly reaches your app for local tunnels, production auto-discovery, and resolution order.
Reading clivly status for the trigger URL
Sync trigger URL
! Still the placeholder (https://<yourDomain.com>/api/clivly/tick)
— remote sync cannot call back into this app.
Replace <yourDomain.com> with your deployed origin, or delete the
line. For local development run `clivly dev`.A warning here is not a failure. Push-only deployments — where your app decides when to sync and nothing needs to call in — can leave this unset permanently.