infrastructure//Supabase//credentials

Supabase credentials are the three values that connect an app to Supabase: the project URL, the publishable key and the secret key. The first two reach the browser; the third never leaves the server.

Supabase credentials are the three values that connect an app to Supabase: the project URL, the publishable key and the secret key. The first two reach the browser; the third never leaves the server.

The three credentials work like an address and two keys.

The URL says where the building is, the publishable key opens the front door, and the secret key is the master key. The front door opens for anyone who has the key, but a bouncer (RLS) checks each visitor's ID.

The URL (SUPABASE_URL) is the address of the Supabase instance. It is public, and anyone may know it.

The publishable key (SUPABASE_ANON_KEY) is a light lock that identifies which app is calling, and every user's browser gets it. It only lets Supabase know who is knocking; the real security is the session token together with RLS. That is why it is safe on the frontend: it can do nothing without a valid session token, and RLS scopes every query to the authenticated user.

The secret key (SUPABASE_SERVICE_ROLE_KEY) bypasses RLS entirely and gives full access to every row in every table. It lives only on the backend, in environment variables, and never reaches the browser; if it leaks, anyone can read any user's data.

All three go in .env.local for local development; in production (Vercel, Cloudflare) they live in the platform's secrets dashboard. The SDK reads the URL and the anon key, and the server reads the URL and the service role key.