How is the demo environment configured for a template that requires API keys?

[mikedownesdev]

I'm preparing a template to contribute here — a Next.js chat app that uses the AI SDK to talk to a hosted MCP server. It needs two environment variables to function (an LLM provider key and our service's API key), and it ships with a .env.example, setup instructions, and a customized Deploy button.

The contributing guide says "the example has to be able to include a demo URL (the Vercel team will deploy it!)." For a template like this that requires secret keys, how is the gallery demo configured?

• Does the deployed demo run without those keys — i.e. the UI renders, but live functionality requires a viewer to deploy their own copy with their own keys?
• Or is a fully-working demo expected, and if so, how are the required secrets provided for it?

We'd prefer the demo not run on our own production keys (to avoid a publicly reachable instance spending against our accounts). Just want to configure the submission correctly. Thanks!

[IMONsergey]

Do not put either credential in the repository or encode a value in the Deploy button. Keep only the variable names in .env.example, and make the Deploy button request those names (for example with Vercel's env parameter) so each person supplies their own values when creating a project.

For the gallery demo, secrets can only be configured on the Vercel project that hosts that demo; they cannot safely travel with the template. That means the practical choices are:

1. provide a bounded demo mode (mock data, a read-only endpoint, strict rate limits, or an explicit “configure your own deployment” state), or
2. have the repository maintainers deploy it with isolated, quota-limited credentials that they control.

A production key owned by the contributor is not a good default for a public demo. Make the no-key state intentional: render the complete UI, explain which capabilities require deployment, and avoid issuing failing requests in a loop. Also document the exact variables and where to obtain them.

The repository's requirement establishes that a demo URL is needed, but it does not by itself authorize sharing credentials. I would include the safe demo behavior in the PR description and explicitly note that maintainers would need to add isolated secrets if they require live chat in the gallery deployment. Vercel's environment-variable documentation covers project-side secret configuration.