Environment variables (VITE_ vs convex env)
VITE_* is public in the browser; API keys go in Convex dashboard or `convex env set`.
Difficulty 2/5
Plain English
Anything in VITE_ is baked into the JS bundle — users can see it. OpenRouter, Gemini, Stripe secrets belong in Convex environment, read inside actions.
Analogy
VITE_ is the menu on the window; convex env is the safe in the back.
Jessica's wedding portal
Same split — never VITE_GEMINI_KEY.
Agentify CRM
VITE_CONVEX_URL in build; model keys only in convex env.
Go deeper
Public vs secret.
Common mistakes
- VITE_OPENAI_API_KEY.
- Committing .env.local.
AI-agent trap
Putting service keys in frontend .env for 'quick test'.
Summary
Rebuild frontend after changing VITE_; convex env applies without rebuild.
Confidence: