Environment variables

Store API keys and other secrets where your Edge Functions can read them. Local development and production load them differently, so set them in both.

Local secrets#

In development, Edge Functions read secrets from supabase/functions/.env, which is automatically loaded on supabase start. Create the file before you start the stack.

1. Create supabase/functions/.env and add each secret with the value you want the function to read. A .env.example template isn't enough on its own, because the runtime reads the values rather than the variable names.

   1
   # supabase/functions/.env
   2
   STRIPE_SECRET_KEY=sk_test_...

2. Add the file to your .gitignore, along with every other env file you create. A .env file committed to Git exposes every secret in it to anyone who can read the repository.

   1
   # .gitignore
   2
   supabase/functions/.env
   3
   .env.local

3. Create the function, then replace its contents to read the secret and report whether it arrived. Return the result of the check rather than the value, so the response never carries the secret.

   1
   supabase functions new hello-world

   1
   // supabase/functions/hello-world/index.ts
   2
   Deno.serve(() => {
   3
     const secretKey = Deno.env.get('STRIPE_SECRET_KEY')
   4
     return Response.json({ configured: Boolean(secretKey) })
   5
   })

4. Start the local stack.

   1
   supabase start

5. Call the function. A configured of true means the runtime handed it the secret.

   1
   curl -i --location --request POST 'http://127.0.0.1:54321/functions/v1/hello-world' \
   2
     --header 'apikey: <SUPABASE_PUBLISHABLE_KEY>'

Your function now reads the secret from your local environment.

Accessing environment variables#

Access an environment variable with the Deno.env.get method, passing the name of the variable you want.

1
Deno.env.get('NAME_OF_SECRET')

In an Edge Function#

1
import { createClient } from 'npm:@supabase/supabase-js@2'
2
3
const SUPABASE_PUBLISHABLE_KEYS = JSON.parse(Deno.env.get('SUPABASE_PUBLISHABLE_KEYS')!)
4
5
// For user-facing operations (respects RLS)
6
const supabase = createClient(
7
  Deno.env.get('SUPABASE_URL')!,
8
  // To use a different API key, change 'default' to your preferred key name
9
  SUPABASE_PUBLISHABLE_KEYS['default']
10
)
11
12
const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
13
// For admin operations (bypasses RLS)
14
const supabaseAdmin = createClient(
15
  Deno.env.get('SUPABASE_URL')!,
16
  // To use a different API key, change 'default' to your preferred key name
17
  SUPABASE_SECRET_KEYS['default']
18
)

In a Deno script#

A Deno script you run yourself, outside supabase functions serve, doesn't read supabase/functions/.env. Pass the file, and grant the script access to the environment with --allow-env:

1
deno run --allow-env --env-file=supabase/functions/.env script.ts

Or set the variable for a single command:

1
STRIPE_SECRET_KEY=sk_test_... deno run --allow-env script.ts

When your function can't read a secret#

The local runtime loads supabase/functions/.env when the stack starts, so a function that returns nothing for a variable usually means the value never reached it.

Restart the stack, or serve the function with the file passed explicitly:

1
supabase functions serve hello-world --env-file supabase/functions/.env

To keep a separate file per environment, name your own and pass it the same way:

1
supabase functions serve --env-file .env.local

Production secrets#

Set secrets for your production Edge Functions in the Dashboard or with the CLI.

Creating or deleting a production secret requires the Owner or Administrator role. Developers can view secrets but not change them. See Access control for the full matrix.

A secret name can't start with SUPABASE_. That prefix is reserved for the variables Supabase injects, and both the Dashboard and the Management API reject it.

Using the Dashboard#

1. Open Edge Function Secrets in the Dashboard.
2. Enter the Key and Value for your secret, then click Save.

You can paste multiple secrets at once.

Using the CLI#

Create a .env file with the secrets you want to deploy. Add it to your .gitignore before you commit.

1
# .env
2
STRIPE_SECRET_KEY=sk_live_...

Push every secret in the file to your remote project with supabase secrets set, which also makes them visible in the Dashboard.

1
supabase secrets set --env-file .env

This command also sets production secrets individually, without a .env file.

1
supabase secrets set STRIPE_SECRET_KEY=sk_live_...

To see the secrets you have set remotely, use supabase secrets list.

1
supabase secrets list

Your deployed functions can now read the secret.

Where local values come from#

A project can hold more than one file that feeds local environment variables, and they aren't interchangeable:

• supabase/functions/.env is the one your Edge Functions read, loaded when the stack starts.
• A file you name yourself, such as .env.local, passed to supabase functions serve with --env-file.
• A .env at the root of your project is the one config.toml reads, through its env() function. See Using secrets inside config.toml. A variable your function needs has to be in supabase/functions/.env too, even when the same value is already in the root file.

You can also set local values in config.toml itself, under [edge_runtime.secrets]:

1
[edge_runtime.secrets]
2
STRIPE_SECRET_KEY = "env(STRIPE_SECRET_KEY)"

Default secrets#

Alongside the secrets you set yourself, Edge Functions have access to these by default:

• SUPABASE_URL: The API gateway for your Supabase project
• SUPABASE_DB_URL: The URL for your Postgres database. Use it to connect directly to your database
• SUPABASE_PUBLISHABLE_KEYS: The publishable keys JSON dictionary for your Supabase API. This is safe to use in a browser when you have Row Level Security enabled
• SUPABASE_SECRET_KEYS: The secret keys JSON dictionary for your Supabase API. This is safe to use in Edge Functions, but never use it in a browser. These keys bypass Row Level Security
• SUPABASE_JWKS: The JSON Web Key Set used to verify user JWTs. Same value served at https://<project-ref>.supabase.co/auth/v1/.well-known/jwks.json

Legacy keys:

• SUPABASE_ANON_KEY: The anon key for your Supabase API. This is safe to use in a browser when you have Row Level Security enabled
• SUPABASE_SERVICE_ROLE_KEY: The service_role key for your Supabase API. This is safe to use in Edge Functions, but never use it in a browser. This key bypasses Row Level Security

In a hosted environment, functions have access to the following environment variables:

• SB_REGION: The region the function was invoked in
• SB_EXECUTION_ID: A UUID for the function instance, or isolate
• DENO_DEPLOYMENT_ID: The version of the function code, formatted as {project_ref}_{function_id}_{version}