Environment variables

Local development and production load secrets differently, so set them in both.

• Local secrets and Production secrets have the steps for each environment.
• Accessing environment variables shows how to read a secret from your function code. When your function can't read a secret covers the local case where nothing arrives.
• Reference explains which file feeds which runtime, and lists the variables Supabase injects for you.

Local secrets#

Locally, Edge Functions read secrets from supabase/functions/.env. The local stack loads that file on supabase start.

1. Create supabase/functions/.env and add each secret with the value you want the function to read. A .env.example template isn't enough, because the runtime reads the values rather than the variable names.

   1
   # supabase/functions/.env
   2
   STRIPE_SECRET_KEY=sk_test_...

2. Add the file to your .gitignore, along with every other env file you create. A .env file committed to Git exposes every secret in it to anyone who can read the repository.

   1
   # .gitignore
   2
   supabase/functions/.env
   3
   .env.local

3. Create the function, then replace its contents to read the secret and report whether it arrived. Return the result of the check rather than the value, so the response never carries the secret.

   1
   supabase functions new hello-world

   1
   // supabase/functions/hello-world/index.ts
   2
   Deno.serve(() => {
   3
     const secretKey = Deno.env.get('STRIPE_SECRET_KEY')
   4
     return Response.json({ configured: Boolean(secretKey) })
   5
   })

4. Start the local stack.

   1
   supabase start

5. Call the function. When configured comes back true, the runtime handed the secret to your function.

   1
   curl -i --location --request POST 'http://127.0.0.1:54321/functions/v1/hello-world' \
   2
     --header 'apikey: <SUPABASE_PUBLISHABLE_KEY>'

Your function now reads the secret from your local environment.

Production secrets#

Set secrets for your production Edge Functions in the Supabase Dashboard or with the Supabase CLI.

Creating or deleting a production secret requires the Owner or Administrator role. Developers can view secrets but not change them. See Access control for the full matrix.

A secret name can't start with SUPABASE_. That prefix is reserved for the variables Supabase injects, and both the Dashboard and the Management API reject it.

Using the Dashboard#

1. Open Edge Function Secrets in the Dashboard.
2. Enter the Key and Value for your secret, then click Save.

You can paste multiple secrets at once.

Using the CLI#

1. Create a .env file with the secrets you want to deploy, and add it to your .gitignore before you commit.

   1
   # .env
   2
   STRIPE_SECRET_KEY=sk_live_...

2. Push every secret in the file to your remote project. The command also makes them visible in the Dashboard.

   1
   supabase secrets set --env-file .env

supabase secrets set also sets production secrets individually, without a .env file.

1
supabase secrets set STRIPE_SECRET_KEY=sk_live_...

List the secrets set on your remote project:

1
supabase secrets list

Your deployed functions can now read the secret.

Accessing environment variables#

Read an environment variable with Deno.env.get, passing the name of the variable.

1
Deno.env.get('NAME_OF_SECRET')

In an Edge Function#

Inside an Edge Function, the Supabase keys are already in the environment. Read them and pass them to createClient:

1
import { createClient } from 'npm:@supabase/supabase-js@2'
2
3
const SUPABASE_PUBLISHABLE_KEYS = JSON.parse(Deno.env.get('SUPABASE_PUBLISHABLE_KEYS')!)
4
5
// For user-facing operations (respects Row Level Security)
6
const supabase = createClient(
7
  Deno.env.get('SUPABASE_URL')!,
8
  // To use a different API key, change 'default' to your preferred key name
9
  SUPABASE_PUBLISHABLE_KEYS['default']
10
)
11
12
const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!)
13
// For admin operations (bypasses Row Level Security)
14
const supabaseAdmin = createClient(
15
  Deno.env.get('SUPABASE_URL')!,
16
  // To use a different API key, change 'default' to your preferred key name
17
  SUPABASE_SECRET_KEYS['default']
18
)

In a Deno script#

A Deno script you run yourself, outside supabase functions serve, doesn't read supabase/functions/.env. Pass the file with --env-file, and grant the script access to environment variables with --allow-env:

1
deno run --allow-env --env-file=supabase/functions/.env script.ts

Or set the variable for a single command:

1
STRIPE_SECRET_KEY=sk_test_... deno run --allow-env script.ts

When your function can't read a secret#

A variable that comes back empty usually means the value never reached the runtime.

Restart the stack, or serve the function with the file passed explicitly:

1
supabase functions serve hello-world --env-file supabase/functions/.env

If the value still doesn't arrive, confirm you edited the file your runtime reads.

Reference#

Look up which file feeds which runtime, and which variables Supabase injects for you.

Where local values come from#

A project can hold more than one file that feeds local environment variables, and they aren't interchangeable:

• supabase/functions/.env is the one your Edge Functions read, loaded when the stack starts.
• A file you name yourself, such as .env.local, is read only when you pass it to supabase functions serve with --env-file.
• A .env at the root of your project is the one config.toml reads, through its env() function. See Using secrets inside config.toml. A variable your function needs also has to be in supabase/functions/.env, even when the root file already holds the same value.

You can also set local values in config.toml itself, under [edge_runtime.secrets]:

1
[edge_runtime.secrets]
2
STRIPE_SECRET_KEY = "env(STRIPE_SECRET_KEY)"

Default secrets#

Alongside the secrets you set yourself, Edge Functions have access to these by default:

Legacy keys:

In a hosted environment, functions also have access to these variables: