Foundation

Environment configuration

Configure browser-safe Supabase credentials and server-only integration keys.

Required values

SUPABASE_URL and SUPABASE_ANON_KEY must be configured together. The anonymous key is used by the request-scoped session client and remains protected by Row Level Security.

Local Supabase runs on the CLI stack engine, which assigns a free port to each project, so there is no fixed local URL. Read the values for the running project and copy them into apps/web/.env:

bash
pnpm --filter database exec supabase status --output-format json

Map env.API_URL to SUPABASE_URL, env.ANON_KEY to SUPABASE_ANON_KEY and env.SERVICE_ROLE_KEY to SUPABASE_SERVICE_ROLE_KEY. pnpm supabase:sync-env does this for you. The same output lists STUDIO_URL and MAILPIT_URL; local Auth emails (confirmation, magic link, recovery) land in Mailpit.

dotenv

SUPABASE_URL=<env.API_URL from supabase status>
SUPABASE_ANON_KEY=<env.ANON_KEY from supabase status>

Privileged integrations

SUPABASE_SERVICE_ROLE_KEY is server-only. It powers explicitly authorized administration, billing webhooks, media operations, and consistency RPCs. Never expose it through loader data or client bundles.

dotenv

SUPABASE_SERVICE_ROLE_KEY=your-server-only-service-key

Optional integrations such as Stripe, email delivery, and AI providers should also be set only in the server environment unless a variable is explicitly documented as browser-safe.

Production

Set NODE_ENV=production and configure HOST and PORT for the target platform. Terminate TLS at the platform edge and forward the request ID header for trace correlation.

Before deploying, run the full repository check:

bash

pnpm check

Still stuck? Share feedback about the documentation.