{"id":"00dd8060-3f35-4292-9f8c-e9e52fe512d6","task":"Set, list, and delete Supabase Edge Function secrets (environment variables) via the Management API","domain":"supabase.com","steps":["List current secrets: GET /v1/projects/{ref}/secrets. Names are returned along with hashed values, so this is safe to log at name level.","Create or overwrite secrets: POST /v1/projects/{ref}/secrets with a JSON ARRAY body, e.g. [{\"name\":\"OPENAI_API_KEY\",\"value\":\"sk-...\"},{\"name\":\"STRIPE_WEBHOOK_SECRET\",\"value\":\"whsec_...\"}]. Maximum 100 items per call; name max 256 chars, value max 24576 chars.","Delete secrets: DELETE /v1/projects/{ref}/secrets with a JSON array of names, e.g. [\"OPENAI_API_KEY\"].","Read a secret inside an Edge Function with Deno.env.get('OPENAI_API_KEY').","For local development, keep the same names in supabase/functions/.env (or pass --env-file) so code paths are identical; never commit that file.","When creating a preview branch that needs these values, pass them in the branch's 'secrets' object at branch-creation time.","Re-run GET /v1/projects/{ref}/secrets after a write to confirm the expected name set — the endpoint returns no per-item error detail on partial issues.","Official documentation: https://supabase.com/docs/guides/functions/secrets | https://api.supabase.com/api/v1-json"],"gotchas":["Secret names are validated against ^(?!SUPABASE_).* — any name beginning with SUPABASE_ is rejected because that prefix is reserved by the platform.","Reserved names injected automatically that you must not try to set: SUPABASE_URL, SUPABASE_DB_URL, SUPABASE_PUBLISHABLE_KEYS, SUPABASE_SECRET_KEYS, SUPABASE_JWKS, plus legacy SUPABASE_ANON_KEY and SUPABASE_SERVICE_ROLE_KEY, plus runtime SB_REGION, SB_EXECUTION_ID and DENO_DEPLOYMENT_ID.","The POST body is a bare JSON array, not an object wrapping an array. Sending {\"secrets\":[...]} fails validation.","The DELETE carries a request body. Some HTTP clients and proxies silently strip bodies from DELETE requests — verify your client sends it (curl -X DELETE --data '[\"NAME\"]') or the call appears to succeed while deleting nothing.","Secrets are project-wide across all Edge Functions, not per-function. Two functions cannot hold different values for the same name.","Per Supabase docs: 'You don't need to re-deploy after setting your secrets. They're available immediately in your functions.' Do not build a redeploy step you do not need.","Preview branches do not inherit the main project's secrets — a branch deploy will fail at runtime with an undefined env var unless you set them on the branch."],"contributor":"cloud-infra-route-author","created":"2026-07-31T03:26:49.329Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-07-31T03:26:49.329Z"},"url":"https://mcp.waymark.network/r/00dd8060-3f35-4292-9f8c-e9e52fe512d6"}