3 min readv1.0.68
Environment Variables & Configuration
Comprehensive guide to all required and optional environment keys across Web, Supabase, Flutter, and Extensions.
Next.js Web Variables (.env.local & .dev.vars)#
Create a laterbox-web/.env.local file for local development or .dev.vars for Cloudflare Pages local testing:
bash
# ==============================================================================
# Supabase Configuration
# ==============================================================================
# Your Supabase Project URL (local: http://127.0.0.1:54321, remote: https://xyz.supabase.co)
NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
# Public Anonymous API Key (safe for client-side browsers)
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
# Service Role Secret Key (REQUIRED for admin tasks: account deletion cascade RPC)
# CAUTION: NEVER expose this on client-side!
SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
# ==============================================================================
# Public App Settings
# ==============================================================================
# Canonical public application URL
NEXT_PUBLIC_APP_URL=https://laterbox.dev
# ==============================================================================
# Optional Cloudflare / Proxy Tokens
# ==============================================================================
# Cloudflare API token for release caching & purge
CLOUDFLARE_API_TOKEN=your_cf_api_token_hereSupabase Edge Functions Secrets#
The enrich-url edge function retrieves metadata and parses YouTube oEmbed links. Set these in your Supabase project:
bash
# Set secrets for local testing (supabase/functions/.env)
supabase secrets set --env-file ./supabase/functions/.env
# Or set individual remote project secrets:
supabase secrets set SUPABASE_URL=https://your-project.supabase.co
supabase secrets set SUPABASE_ANON_KEY=eyJhbGci...
supabase secrets set SUPABASE_SERVICE_ROLE_KEY=eyJhbGci...
# Optional: Google / YouTube Data API Key for fallback high-res metadata
supabase secrets set YOUTUBE_API_KEY=AIzaSy...Flutter Client Configuration#
The Flutter mobile and desktop apps can read credentials at compile time via --dart-define or from lib/core/constants/api_constants.dart:
bash
# Run with compile-time defines:
flutter run -d macos \
--dart-define=SUPABASE_URL=https://your-project.supabase.co \
--dart-define=SUPABASE_ANON_KEY=eyJhbGciOi...| Variable | Description | Client Exposure |
|---|---|---|
SUPABASE_URL | Supabase API Gateway endpoint | Safe (Public) |
SUPABASE_ANON_KEY | Row-Level Security enabled anonymous key | Safe (Public) |
Browser Extension Configuration#
In extension/.env (built into extension/dist/):
bash
# Base URL for OAuth token handshake and extension connect page
VITE_LATERBOX_APP_URL=https://laterbox.dev
VITE_SUPABASE_URL=https://your-project.supabase.co
VITE_SUPABASE_ANON_KEY=eyJhbGciOi...Security & Key Handling Rules#
- Never commit secrets: Ensure
.env,.env.local,.dev.vars, and*.keyare in your.gitignore. - Anonymous vs Service Role: The
NEXT_PUBLIC_SUPABASE_ANON_KEYis constrained by PostgreSQL Row Level Security. TheSUPABASE_SERVICE_ROLE_KEYbypasses all RLS and must strictly remain on server-side endpoints (such as/api/account/delete). - Rotating Keys: If a service role key is compromised, regenerate it immediately in the Supabase Dashboard under Project Settings > API.
Questions or suggestions for this documentation?