Ctrl+Z Therapy
CasesQuick answersGuides10-minute checklistHow we testCartoonSend it in

Why is my Supabase Edge Function secret showing in Inspect?

Ship ItChecked against the official source

Source checked 5 Oct 2026 · Published 21 Oct 2026 · Last reviewed 21 Oct 2026 · By Ctrl+Z Therapy (how we test)

The short answer

Supabase Edge Function secrets are read on the server, and Lovable's docs say they never reach the browser. So if your key shows up in Inspect, the app put it somewhere public. Three usual ways: it's in a variable starting with VITE_ or NEXT_PUBLIC_, which Vite and Next.js bundle into the code every visitor downloads; your function sends the key back in its response; or the browser calls the other service directly with the key.

What to do

  1. Move the key out of any VITE_ or NEXT_PUBLIC_ variable and save it as an Edge Function secret.
  2. Call the other service from the Edge Function, not from the browser. Return the result, never the key.
  3. Replace any key that was exposed.
  4. Ask your AI tool: "Move every secret API key out of VITE_ variables into Edge Function secrets, and call the service from the Edge Function. Never return the key in a response."

Good to know

  • The Supabase publishable key is different: Supabase says it's safe to expose online.
  • Replacing an exposed key is our general advice, not a line from these docs.

Source

Checked on 5 Oct 2026. Prices, limits and settings change, so check the source before you rely on them.

Related