Environment Variables

Browser vs server scope.

Browser (build-time, via Vite)

Variable	Purpose
VITE_SUPABASE_URL	Supabase project URL
VITE_SUPABASE_PUBLISHABLE_KEY	Anon/publishable key (RLS still applies)
VITE_SUPABASE_PROJECT_ID	Project ref

Read in client code with import.meta.env.VITE_*. Values are bundled into the JS output, so never put secrets here.

Server (runtime, via process.env)

Variable	Purpose
SUPABASE_URL	Mirrors the browser URL for SSR
SUPABASE_PUBLISHABLE_KEY	Server-side publishable key
SUPABASE_SERVICE_ROLE_KEY	Admin key — bypasses RLS, server only
TEAGENTIC_AI_KEY	Teagentic AI Gateway key

Read inside .handler() of a server function, never at module top level (env injection happens at call time).

Storing secrets

In production, set the server-side variables via your hosting provider’s secrets manager (Cloudflare Workers secrets, Vercel env vars, Fly secrets, etc.) — never commit them to the repo. The browser VITE_* values are safe to bake into the build.