---
title: ".env.local - Air Market"
description: "You have a front-end-only site with nowhere to run server code, and you want a chat feature in it. This shows the one setup meant for production: point the provider at the hosted cloud with a public…"
canonical: "https://airmarket.ai/app/spa-without-runtime"
---

[Air Market](/) / [Developer Tools](/category/devtools) / .env.local

Skill by [CopilotKit](/@copilotkit)

# .env.local

Add chat to a static front end with no backend at all

## What this does

You have a front-end-only site with nowhere to run server code, and you want a chat feature in it. This shows the one setup meant for production: point the provider at the hosted cloud with a public key. It also flags the two shortcuts that look fine in development but expose your credentials once shipped.

### Top 3 things it does for you

- Wire up chat in a Vite or React Router app
- Point the provider at the hosted cloud instead of a server
- Get the public key you need to go live

## Information

**.env.local at a glance**

|  |  |
| --- | --- |
| Kind | Skill |
| Publisher | [CopilotKit](/@copilotkit) |
| Category | [Developer Tools](/category/devtools) |
| Works with | Agent Skills - an open standard supported by 40+ agents |
| Size | 8 KB |
| Licence | MIT |
| Repository | [CopilotKit/CopilotKit](https://github.com/CopilotKit/CopilotKit/tree/7ed1d2a61852b01616fee4f2341d96a81f7f8c19/skills/spa-without-runtime) |
| GitHub stars | 37,014 (as of Nov 2026) |

## Security report

**Verified.** AIR scanned this exact version of .env.local and flagged nothing. AIR's verdict: **safe**.

**What .env.local's check was run against**

|  |  |
| --- | --- |
| Commit | 7ed1d2a61852b01616fee4f2341d96a81f7f8c19 |
| Content hash | 6a5d53a8fddbbea6b064bb50df0674ca3a85de7da29c521dff5c7ed41f8e8b09 |
| Files read | [Browse the files at this exact commit](https://github.com/CopilotKit/CopilotKit/blob/7ed1d2a61852b01616fee4f2341d96a81f7f8c19/skills/spa-without-runtime/SKILL.md) |

A scan is named by the exact content it read, not by a version number. A different version is a different artifact, and nothing here applies to a version AIR has not scanned.

[Read the full security report for .env.local](/security/spa-without-runtime)

## About .env.local

This covers building a pure-client CopilotKit v2 single-page app with no server runtime, by pointing CopilotKitProvider at CopilotKit Cloud using a publicApiKey. It is presented as the only production-safe path for a SPA.

It walks through Vite and plain React Router SPA wiring, getting a publicApiKey from cloud.copilotkit.ai, and why server-side rendering is not a concern here. publicLicenseKey is accepted as an alias for publicApiKey, and publicApiKey wins if both are set.

It is also explicit about what not to ship: agents__unsafe_dev_only and selfManagedAgents are dev-only aliases that leak credentials in production. Reach for this when you have no backend and want chat in a pure-SPA deployment such as Vite, GitHub Pages, or S3.

## What's inside

- SKILL.md - instructions

## Questions

### Is .env.local safe to install?

AIR scanned this exact version of .env.local and flagged nothing. AIR's verdict: safe. The verdict is named by the content that was read, at commit 7ed1d2a61852, so it cannot drift onto a version nobody scanned. The full report is at https://airmarket.ai/security/spa-without-runtime.

### How do I install .env.local?

Open https://airmarket.ai/app/spa-without-runtime on Air Market and use the install action: Air Market hands Claude a prompt naming this exact skill, and Claude sets it up. Source, pinned to the exact commit this listing describes: https://github.com/CopilotKit/CopilotKit/tree/7ed1d2a61852b01616fee4f2341d96a81f7f8c19/skills/spa-without-runtime. Install from that link, not the branch.

## Related on Air Market

- [More Developer Tools listings](/category/devtools)
- [Everything by CopilotKit](/@copilotkit)

---

Canonical URL: <https://airmarket.ai/app/spa-without-runtime>