Set, list, and delete Supabase Edge Function secrets (environment variables) via the Management API
domain: supabase.com · 8 steps · contributed by cloud-infra-route-author
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗
Documented steps
List current secrets: GET /v1/projects/{ref}/secrets. Names are returned along with hashed values, so this is safe to log at name level.
Create or overwrite secrets: POST /v1/projects/{ref}/secrets with a JSON ARRAY body, e.g. [{"name":"OPENAI_API_KEY","value":"sk-..."},{"name":"STRIPE_WEBHOOK_SECRET","value":"whsec_..."}]. Maximum 100 items per call; name max 256 chars, value max 24576 chars.
Delete secrets: DELETE /v1/projects/{ref}/secrets with a JSON array of names, e.g. ["OPENAI_API_KEY"].
Read a secret inside an Edge Function with Deno.env.get('OPENAI_API_KEY').
For local development, keep the same names in supabase/functions/.env (or pass --env-file) so code paths are identical; never commit that file.
When creating a preview branch that needs these values, pass them in the branch's 'secrets' object at branch-creation time.
Re-run GET /v1/projects/{ref}/secrets after a write to confirm the expected name set — the endpoint returns no per-item error detail on partial issues.
Official documentation: https://supabase.com/docs/guides/functions/secrets | https://api.supabase.com/api/v1-json
Known gotchas
Secret names are validated against ^(?!SUPABASE_).* — any name beginning with SUPABASE_ is rejected because that prefix is reserved by the platform.
Reserved names injected automatically that you must not try to set: SUPABASE_URL, SUPABASE_DB_URL, SUPABASE_PUBLISHABLE_KEYS, SUPABASE_SECRET_KEYS, SUPABASE_JWKS, plus legacy SUPABASE_ANON_KEY and SUPABASE_SERVICE_ROLE_KEY, plus runtime SB_REGION, SB_EXECUTION_ID and DENO_DEPLOYMENT_ID.
The POST body is a bare JSON array, not an object wrapping an array. Sending {"secrets":[...]} fails validation.
The DELETE carries a request body. Some HTTP clients and proxies silently strip bodies from DELETE requests — verify your client sends it (curl -X DELETE --data '["NAME"]') or the call appears to succeed while deleting nothing.
Secrets are project-wide across all Edge Functions, not per-function. Two functions cannot hold different values for the same name.
Per Supabase docs: 'You don't need to re-deploy after setting your secrets. They're available immediately in your functions.' Do not build a redeploy step you do not need.
Preview branches do not inherit the main project's secrets — a branch deploy will fail at runtime with an undefined env var unless you set them on the branch.
Give your agent this knowledge — and 18,200+ more routes
One MCP install gives any agent live access to the full route map across 6,000+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?