Supabase · Edge Functions · all subjects

edge functions/environment

42 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Environment file location for Edge Functions

The environment file for Edge Functions should be created at `supabase/.env` in the project directory. This file contains environment variables like AWS credentials and configuration paths that are loaded when the function runs locally or after being set in the hosted project.

Store credentials in project secrets

Store credentials and sensitive configuration in Supabase project secrets and access them via environment variables. This is the recommended way to handle secrets in Edge Functions.

Local SSL development requires certificate and environment variables

For local development with SSL connections, download the SSL certificate from Database Settings and add two environment variables to your local .env file: SSL_CERT_FILE (set to the path of the downloaded certificate) and DENO_TLS_CA_STORE=mozilla,system. Then restart the local development server with: supabase functions serve your-function

Production Edge Functions use SSL by default

Deployed edge functions are pre-configured to use SSL for connections to the Supabase database. No extra configurations are needed.

Set OpenAI SDK secrets for Llamafile

Set the following function secrets to point the OpenAI SDK to the Llamafile server: echo "OPENAI_BASE_URL=http://host.docker.internal:8080/v1" >> supabase/functions/.env and echo "OPENAI_API_KEY=sk-XXXXXXXX" >> supabase/functions/.env

Set AI_INFERENCE_API_HOST for Ollama

Set a function secret called AI_INFERENCE_API_HOST to point to the Ollama server. For local Docker development, use: echo "AI_INFERENCE_API_HOST=http://host.docker.internal:11434" >> supabase/functions/.env

Set AI_INFERENCE_API_HOST for Llamafile

Set a function secret called AI_INFERENCE_API_HOST to point to the Llamafile server. For local Docker development, use: echo "AI_INFERENCE_API_HOST=http://host.docker.internal:8080" >> supabase/functions/.env

Environment variables for @supabase/server

The @supabase/server SDK reads configuration from: SUPABASE_URL (project URL), SUPABASE_PUBLISHABLE_KEYS (named publishable keys as JSON object), SUPABASE_SECRET_KEYS (named secret keys as JSON object), and SUPABASE_JWKS (JSON Web Key Set for verifying user JWTs). On the Supabase platform and in local development with the CLI, these are auto-provisioned. Local development also accepts fallback single-key setup with SUPABASE_PUBLISHABLE_KEY and SUPABASE_SECRET_KEY.

SUPABASE_PUBLISHABLE_KEYS different in development and production

The SUPABASE_PUBLISHABLE_KEYS differ between development and production environments. Publishable keys can be found in the Supabase dashboard under Settings > API.

Set environment secrets for Edge Functions

Environment secrets for Edge Functions can be set using the CLI command: supabase secrets set CLOUDFLARE_SECRET_KEY=your_secret_key. These secrets are accessed in the function code using Deno.env.get().

Generate and store webhook secrets

Webhook secrets are generated in the Supabase dashboard Auth Hooks section and are in the format 'v1,whsec_<base64_secret>'. When using the secret for verification, remove the 'v1,whsec_' prefix. Store the full secret (with prefix) in the `.env` file.

Set secrets for Edge Functions

Secrets should be stored in the `.env` file at `supabase/functions/.env` and deployed with the command `supabase secrets set --env-file supabase/functions/.env`. These secrets can then be accessed in functions using `Deno.env.get('<SECRET_NAME>')`.

Access environment variables in Edge Functions

Environment variables and secrets in Edge Functions are accessed using `Deno.env.get('<VARIABLE_NAME>')`. The return value is a string or undefined.

Environment variables for GitHub Actions deployment

When deploying Edge Functions via GitHub Actions, set two environment variables: `SUPABASE_ACCESS_TOKEN` (your Supabase access token) and `PROJECT_ID` (your Supabase project ID).

Environment variables in Edge Functions

Create a .env file in supabase/functions directory with environment variables like ELEVENLABS_API_KEY=value. Access them in functions using Deno.env.get('VARIABLE_NAME').

Environment variables in supabase/functions/.env

Environment variables for Edge Functions are stored in a `.env` file located at `supabase/functions/.env`. Variables defined here can be accessed in function code using `Deno.env.get('VARIABLE_NAME')`.

Set function secrets with supabase secrets set

To set secrets in a deployed Supabase project, run the command `supabase secrets set --env-file supabase/functions/.env`. This uploads the environment variables defined in the local `.env` file to the Supabase project.

Environment variables in edge functions

Supabase Edge Functions can access environment variables using Deno.env.get(), such as Deno.env.get('EXPO_ACCESS_TOKEN'). Secrets are set using 'supabase secrets set --env-file .env.local' where .env.local contains the secret values.

Store API keys in .env file for local development

API keys and secrets should be stored in a .env file during local development, then set in Edge Function Secrets Management when deploying to Supabase.

Access environment variables with Deno.env.get()

Use `Deno.env.get('VARIABLE_NAME')` to retrieve environment variables in Edge Functions, such as `Deno.env.get('RESEND_API_KEY')`.

Set secrets in Edge Function Secrets Management dashboard

After deploying an Edge Function to Supabase, set API keys and secrets using the Edge Function Secrets Management interface in the dashboard at /dashboard/project/_/functions/secrets, rather than using .env files.

Upstash Redis REST credentials for environment

Two environment variables are required: UPSTASH_REDIS_REST_URL (the REST endpoint URL) and UPSTASH_REDIS_REST_TOKEN (the authentication token). These are found in the Upstash Console under Details > REST API > .env.

Maximum number of secrets per project

Edge Functions projects can have a maximum of 100 secrets.

Maximum secret size

The maximum size for a secret is 48 KiB (24,576 characters).

Secret name length limit

Secret names can be up to 256 characters long.

Secret name prefix restriction

Secret names must NOT start with the prefix 'SUPABASE_' as this prefix is reserved.

Database connection credentials for Edge Functions

Get database connection credentials (DB_HOSTNAME, DB_PASSWORD, DB_SSL_CERT) from the project's Connect panel and store them in an .env file. The DB_SSL_CERT is a full certificate block that begins with '-----BEGIN CERTIFICATE-----' and ends with '-----END CERTIFICATE-----'.

TLS certificate configuration for Postgres connections in Edge Functions

When creating a Postgres pool from an Edge Function, pass the SSL certificate via the tls object with caCertificates array: { tls: { caCertificates: [Deno.env.get('DB_SSL_CERT')!] } }.

Store auth tokens securely for scheduled Edge Function calls

To access auth tokens securely for Edge Function calls from scheduled jobs, store them in Supabase Vault rather than hardcoding them.

Never commit .env files to Git

Never check .env files into Git. Instead, add the path to .env files to your .gitignore to prevent accidentally committing secrets.

Setting production secrets via CLI

Production secrets can be set using the supabase secrets set command. You can set all secrets from a .env file with supabase secrets set --env-file .env, or set individual secrets with supabase secrets set STRIPE_SECRET_KEY=sk_live_... The secrets are available immediately in your functions without requiring a re-deployment.

Listing production secrets via CLI

To view all secrets that have been set remotely for your Edge Functions, use the command: supabase secrets list

Setting production secrets via Dashboard

Production secrets for Edge Functions can be set through the Supabase Dashboard by visiting the Edge Function Secrets Management page. Add the Key and Value for your secret and press Save. Multiple secrets can be pasted at once.

Production secrets are available immediately without re-deployment

After setting secrets using supabase secrets set or the Dashboard, they are available immediately in your Edge Functions without requiring a re-deployment.

Accessing environment variables with Deno.env.get()

Environment variables in Edge Functions are accessed using Deno's built-in handler: Deno.env.get('NAME_OF_SECRET'). This method retrieves the value of the specified environment variable.

Default environment variables available in Edge Functions

Edge Functions have access to the following environment variables by default: SUPABASE_URL (the API gateway for your Supabase project), SUPABASE_DB_URL (the URL for your Postgres database for direct connections), SUPABASE_PUBLISHABLE_KEYS (the publishable keys JSON dictionary, safe to use in a browser with Row Level Security enabled), SUPABASE_SECRET_KEYS (the secret keys JSON dictionary, safe to use in Edge Functions but must never be used in a browser as it bypasses Row Level Security), and SUPABASE_JWKS (the JSON Web Key Set used to verify user JWTs, same value served at https://<project-ref>.supabase.co/auth/v1/.well-known/jwks.json).

Legacy default environment variables in Edge Functions

Edge Functions have access to these legacy environment variables: SUPABASE_ANON_KEY (the anon key for your Supabase API, safe to use in a browser with Row Level Security enabled) and SUPABASE_SERVICE_ROLE_KEY (the service_role key for your Supabase API, safe to use in Edge Functions but must never be used in a browser as it bypasses Row Level Security).

Hosted environment variables in Edge Functions

In a hosted environment, Edge Functions have access to the following environment variables: SB_REGION (the region the function was invoked in), SB_EXECUTION_ID (a UUID of the function instance/isolate), and DENO_DEPLOYMENT_ID (the version of the function code in the format {project_ref}_{function_id}_{version}).

Example: Creating Supabase clients with environment variables

import { createClient } from 'npm:@supabase/supabase-js@2' const SUPABASE_PUBLISHABLE_KEYS = JSON.parse(Deno.env.get('SUPABASE_PUBLISHABLE_KEYS')!) // For user-facing operations (respects RLS) const supabase = createClient( Deno.env.get('SUPABASE_URL')!, // If you want to use a different api key, change 'default' to your preferred key name SUPABASE_PUBLISHABLE_KEYS['default'] ) const SUPABASE_SECRET_KEYS = JSON.parse(Deno.env.get('SUPABASE_SECRET_KEYS')!) // For admin operations (bypasses RLS) const supabaseAdmin = createClient( Deno.env.get('SUPABASE_URL')!, // If you want to use a different api key, change 'default' to your preferred key name SUPABASE_SECRET_KEYS['default'] )

Local development environment variables with .env file

In development, environment variables can be loaded through a .env file placed at supabase/functions/.env, which is automatically loaded when running supabase start. Alternatively, use the --env-file option with supabase functions serve to specify a custom file name like .env.local.

Serving functions locally with custom env file

To serve Edge Functions locally with a custom environment file, use: supabase functions serve hello-world --env-file .env.local. This allows management of different environments like development and staging.

SB_REGION environment variable

Functions have access to the SB_REGION environment variable, which contains the AWS region the function was invoked in. This is useful if you have read replicas and want to connect to a different replica based on the region.

Give your agent this brain