mirror of
https://github.com/supabase/supabase.git
synced 2026-09-22 13:37:53 +08:00
Miranda Limonczenko
36749659e6
Five reports on this page, four of them the same confusion: which .env file does what. Where local values come from is a new section listing the files that feed a local environment: supabase/functions/.env, a file you name yourself, the root .env that config.toml reads through env(), and [edge_runtime.secrets]. It says a value in one is not a value in the other. That is what CLI-818 asked for in as many words, the duplication FDBKIN-11884 complains about, and the config route FDBKIN-12716 raises. It sits with the other reference section rather than inside the local procedure, because it answers what the parts are rather than how to do something. Accessing environment variables splits into an Edge Function and a Deno script you run yourself, where neither env file applies. Deno.env.get needs --allow-env, so both commands pass it; without the flag the script prompts, and fails outright when nothing is there to answer. FDBKIN-7937. Production secrets now states who can set one, and the reserved prefix. Also calls Deno.env.get a method rather than a handler, which is what it is. The wording came in with the style pass at the bottom of the stack; fixing it here avoids restacking four branches for one word. Two claims from the source reports are deliberately not here. FDBKIN-34962 reports that adding a secret requires OWNER. The access control matrix in guides/platform/access-control.mdx says Owner or Administrator can create and delete, and Developer can view. The reporter found their version by external searching, so the page states what our own matrix says. supabase/agent-skills#452 reports that a secret value cannot be recovered after saving. SecretResponse_Output in the Management API spec returns value as a required field, and the Dashboard renders it, so that does not hold up from what I can check here. Left out rather than guessed at; the issue stays open. The reserved prefix is not a third-party host restriction as supabase/agent-skills#553 frames it. CreateSecretBody carries pattern ^(?!SUPABASE_).*, AddNewSecretForm.tsx:42 rejects the same, and the CLI filters SUPABASE_-prefixed names out of the local function environment. It is ours, and the page says so.