Home

Secrets and Environment Variables

It's common that you will need to use sensitive information or environment-specific variables inside your Edge Functions. You can access these using Deno's built-in handler

Deno.env.get(MY_SECRET_NAME)

Default secrets#

By default, Edge Functions have access to these secrets:

  • SUPABASE_URL: The API gateway for your Supabase project.
  • SUPABASE_ANON_KEY: The anon key for your Supabase API. This is safe to use in a browser when you have Row Level Security enabled.
  • SUPABASE_SERVICE_ROLE_KEY: The service_role key for your Supabase API. This is safe to use in Edge Functions, but it should NEVER be used in a browser. This key will bypass Row Level Security.
  • SUPABASE_DB_URL: The URL for your PostgreSQL database. You can use this to connect directly to your database.

Local secrets#

Let's create a local file for storing our secrets, and inside it we can store a secret MY_NAME:

1echo "MY_NAME=Yoda" >> ./supabase/.env.local

This creates a new file ./supabase/.env.local for storing your local development secrets.

caution

Never check your .env files into Git!

Now let's access this environment variable MY_NAME inside our Function. Anywhere in your function, add this line:

console.log(Deno.env.get('MY_NAME'))

Now we can invoke our function locally, by serving it with our new .env.local file:

1supabase functions serve hello-world --env-file ./supabase/.env.local

When the function starts you should see the name “Yoda” output to the terminal.

Production secrets#

Let's create a .env for production. In this case we'll just use the same as our local secrets:

1cp ./supabase/.env.local ./supabase/.env

This creates a new file ./supabase/.env for storing your production secrets.

caution

Never check your .env files into Git!

Let's push all the secrets from the .env file to our remote project using supabase secrets set:

1supabase secrets set --env-file ./supabase/.env
2
3# You can also set secrets individually using:
4supabase secrets set MY_NAME=Chewbacca

You don't need to re-deploy after setting your secrets.

To see all the secrets which you have set remotely, use supabase secrets list:

1supabase secrets list
Need some help?

Not to worry, our specialist engineers are here to help. Submit a support ticket through the Dashboard.