Secrets

Adding a secret

1. Open Cloud → Secrets.
2. Click Add secret.
3. Enter a name (uppercase, e.g., STRIPE_SECRET_KEY) and value.
4. Save. The secret is available immediately, no redeploy needed.

Reading in an edge function

Deno.serve(async (req) => {
  const apiKey = Deno.env.get("STRIPE_SECRET_KEY");
  if (!apiKey) return new Response("Missing key", { status: 500 });
  // use it
});

Predefined secrets

• SUPABASE_URL
• SUPABASE_ANON_KEY
• SUPABASE_SERVICE_ROLE_KEY (only in edge functions!)
• SUPABASE_DB_URL
• MASTER_API_KEY — for AI Gateway

Best practices

• Use the service role key exclusively in edge functions.
• Log only the names of the secrets, never the values.

Key rotation

1. Generate a new key at the provider.
2. Overwrite the value in Cloud → Secrets.
3. Invalidate the old key at the provider.