From unicore-skills
Use when adding, changing, validating, or auditing service environment variables, Railway variables, local .env files, or sealed secrets for a company service.
How this skill is triggered — by the user, by Claude, or both
Slash command
/unicore-skills:managing-service-envThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Use this skill whenever a company service gets a new environment variable or a production value changes.
Use this skill whenever a company service gets a new environment variable or a production value changes.
The goal is simple:
Use Seal only for high-sensitivity values.
Use these files:
| File | Purpose |
|---|---|
.env.example | Committed reference for every required key |
.env.local | Local developer values, never committed |
src/lib/env.ts | Runtime validation with zod |
Make sure .gitignore contains:
.env*.local
Rules:
.env.example..env.example safe: empty placeholders, public values, or safe local-only defaults.src/lib/env.ts when it is safe for the framework path.NEXT_PUBLIC_* or any client-side env prefix.Railway Variables are the source of truth for production values.
Use the linked project and service. Before setting variables, confirm:
railway status --json
Set non-secret values directly:
railway variable set AUTH_URL=https://web-production-abc123.up.railway.app --service web --environment production
railway variable set AUTH_TRUST_HOST=true --service web --environment production
Set reference variables with quotes so the shell does not expand them:
railway variable set 'DATABASE_URL=${{Postgres.DATABASE_URL}}' --service web --environment production
Set secret values through stdin when possible. This avoids shell history leaks:
openssl rand -base64 32 | railway variable set AUTH_SECRET --stdin --service web --environment production
You can list variables for a service:
railway variable list --service web --environment production
After adding, changing, or deleting variables, review Railway staged changes and deploy or redeploy when needed.
Railway sealed variables are available to builds and deployments, but their values cannot be read back from the UI, API, or CLI.
Seal only high-sensitivity values.
| Variable type | Examples |
|---|---|
| Passwords and connection strings with credentials | DATABASE_URL, REDIS_URL |
| Signing or encryption secrets | AUTH_SECRET, ENCRYPTION_KEY, JWT_SECRET |
| OAuth client secrets | OKTA_CLIENT_SECRET |
| API tokens and provider keys | LITELLM_API_KEY, OPENAI_API_KEY, ANTHROPIC_API_KEY, GEMINI_API_KEY, OKTA_API_TOKEN |
| Webhook signing secrets | STRIPE_WEBHOOK_SECRET, SLACK_SIGNING_SECRET |
| Private package or registry tokens | NPM_TOKEN, GITHUB_TOKEN |
| Variable type | Examples |
|---|---|
| Public URLs | AUTH_URL, LITELLM_BASE_URL, public callback URLs |
| Public issuer URLs | OKTA_ISSUER |
| Client IDs and app IDs | OKTA_CLIENT_ID, OAuth client IDs |
| Boolean flags | AUTH_TRUST_HOST, feature flags |
| Environment names | NODE_ENV, RAILWAY_ENVIRONMENT_NAME |
| Service names and domains | custom domain names, service labels |
Why keep public config readable:
railway variable list, railway run, or railway shell.Railway CLI can set variables, but sealing is a dashboard action.
After every Railway env setup or audit, print a seal action list for the user. Do not only say "seal the secrets". Name each variable and explain why.
Use this format:
Required Railway Seal actions:
1. Open Railway -> project -> service -> Variables.
2. For each variable below, open the three-dot menu and choose Seal.
3. Confirm only after the value is correct. Sealed values cannot be read back.
Must seal:
- AUTH_SECRET - signing secret
- DATABASE_URL - contains database credentials
- OKTA_CLIENT_SECRET - OAuth client secret
Keep readable:
- AUTH_URL - public app URL
- AUTH_TRUST_HOST - boolean flag
- OKTA_CLIENT_ID - public app ID
- OKTA_ISSUER - public issuer URL
The list must match the actual service. Add provider keys, webhook secrets, registry tokens, and private API tokens to Must seal. Add public IDs, URLs, domains, service names, and flags to Keep readable.
Do not claim the Railway env work is fully complete until one of these is true:
In Railway:
Seal only after the value is correct. If a sealed value is wrong, update it with the correct value. You cannot read the old value back.
.env.example contains every required key..env.local is ignored by git.src/lib/env.ts validates runtime keys where appropriate.NEXT_PUBLIC_ or exposed to client code.railway variable set KEY --stdin for secrets.${{Service.KEY}}..env.example. Use empty placeholders or safe local values only.Guides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.
npx claudepluginhub unicore-railway/unicore-skills --plugin unicore-skills