Inspecting function environment variables

Secrets on SupaHost are write-only: once saved, their values aren't shown again in the dashboard. To check what a function actually sees, read the environment from inside the function and log names, never values.

What every function gets

SupaHost injects four variables into every function:

There is no SUPABASE_DB_URL. Functions reach the database through supabase-js and the Data API instead of a direct Postgres connection. See Using the database from a function.

Your own secrets come from the Secrets card in Dashboard → your project → Functions tab. They're shared by all functions in the project.

Check which variables are set

Deploy a short diagnostic function, call it once, read the result in the Logs card, then delete it.

// functions/env-check/index.ts
const expected = ['SUPABASE_URL', 'RESEND_API_KEY', 'STRIPE_SECRET_KEY', 'STRIPE_WEBHOOK_SECRET']

Deno.serve(() => {
  const env = Deno.env.toObject()
  for (const name of expected) {
    const value = env[name]
    console.log(name, value ? `set (${value.length} chars)` : 'MISSING')
  }
  console.log('all names:', Object.keys(env).sort().join(', '))
  return Response.json({ ok: true })
})

The length helps catch a value pasted with a trailing space or newline, without exposing it. The response body is deliberately empty of details: with Require JWT on, anyone holding the public anon key can call a function, so don't return environment information to the caller.

Common problems

• A new secret isn't visible yet. Changes reach functions within about a minute. Wait, then call again.
• The name doesn't match. Names are case sensitive: Resend_Api_Key and RESEND_API_KEY are different. Allowed names start with a letter or underscore and contain letters, digits and underscores, up to 100 characters.
• You can't create a SUPABASE_ secret. That prefix is reserved for the injected variables. Use a different name, such as APP_SUPABASE_REGION.
• The value is wrong. You can't view it, so overwrite it: save the secret again with the correct value.
• It works locally but not deployed. A local .env file isn't uploaded. Add each value in the Secrets card.
• You hit the cap. A project can hold up to 100 secrets, each up to 10,000 characters. Combine related values into one JSON secret if needed.

On SupaHost

Secrets are stored in Vault and never shown again after you save them. Only the project owner can add or change them; team members can see the Functions tab read-only. An AI agent over MCP can deploy and read logs, so it can run the diagnostic above for you, but it can't read secret values directly.

Related

• Environment variables and secrets
• Edge Function returns 500
• Logs and debugging
• Keeping keys safe