Overview
Environment variables are set in apps/web/.env.local for local development and in Vercel project settings for production. Edge Function secrets are managed separately via the Supabase CLI.
Never commit .env.local or any file containing secret keys to version control. The .gitignore is configured to exclude these files.
Variable Reference
Supabase
| Variable | Type | Required | Description |
|---|
NEXT_PUBLIC_SUPABASE_URL | Public | Yes | Supabase project URL (https://hcyyegiialkkjcdxpfat.supabase.co) |
NEXT_PUBLIC_SUPABASE_ANON_KEY | Public | Yes | Supabase anonymous/public API key |
SUPABASE_SERVICE_ROLE_KEY | Secret | Yes | Service role key for admin operations (bypasses RLS) |
NEXT_PUBLIC_ prefixed variables are exposed to the browser. Never put secret keys in NEXT_PUBLIC_ variables.
Stripe Billing
| Variable | Type | Required | Description |
|---|
STRIPE_SECRET_KEY | Secret | Yes | Stripe API secret key |
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY | Public | Yes | Stripe publishable key for client-side Elements |
STRIPE_WEBHOOK_SECRET | Secret | Yes | Webhook endpoint signing secret (whsec_...) |
Application
| Variable | Type | Required | Description |
|---|
NEXT_PUBLIC_APP_URL | Public | Yes | Base URL of the app (http://localhost:3000 locally, https://app.securatlas.com in production) |
| Variable | Type | Required | Description |
|---|
ANTHROPIC_API_KEY | Secret | Yes | Anthropic Claude API key for evidence classification |
ANTHROPIC_API_KEY must only be used server-side. It is never sent to the client. All AI calls go through Server Actions or Edge Functions.
Integration OAuth
| Variable | Type | Required | Description |
|---|
INTEGRATION_STATE_SECRET | Secret | Yes | Secret for signing OAuth state parameters (CSRF protection) |
GOOGLE_CLIENT_ID | Secret | Yes | Google OAuth client ID for Google Workspace integration |
GOOGLE_CLIENT_SECRET | Secret | Yes | Google OAuth client secret |
INTEGRATION_REDIRECT_URI | Secret | Yes | OAuth callback URL for Azure AD / generic integrations |
GWS_REDIRECT_URI | Secret | Yes | OAuth callback URL for Google Workspace integration |
Redirect URIs must exactly match what is configured in the provider’s OAuth app settings (Azure Portal, Google Cloud Console). Mismatches cause silent OAuth failures.
Edge Function Secrets
Edge Functions use a separate secrets store managed via the Supabase CLI:
# Set a secret
supabase secrets set ANTHROPIC_API_KEY=sk-ant-...
# List all secrets
supabase secrets list
# Unset a secret
supabase secrets unset ANTHROPIC_API_KEY
SUPABASE_URLSUPABASE_ANON_KEYSUPABASE_SERVICE_ROLE_KEYSUPABASE_DB_URL
Additional secrets must be set explicitly.
Local Development Setup
# apps/web/.env.local
NEXT_PUBLIC_SUPABASE_URL=https://hcyyegiialkkjcdxpfat.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=eyJ...
SUPABASE_SERVICE_ROLE_KEY=eyJ...
NEXT_PUBLIC_APP_URL=http://localhost:3000
STRIPE_SECRET_KEY=sk_test_...
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...
STRIPE_WEBHOOK_SECRET=whsec_...
ANTHROPIC_API_KEY=sk-ant-...
INTEGRATION_STATE_SECRET=random-32-char-string
GOOGLE_CLIENT_ID=123456789.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=GOCSPX-...
INTEGRATION_REDIRECT_URI=http://localhost:3000/api/integrations/callback
GWS_REDIRECT_URI=http://localhost:3000/api/integrations/google/callback
Vercel Configuration
In Vercel project settings, add all variables under Settings > Environment Variables. Use different values for Preview and Production environments:
| Environment | NEXT_PUBLIC_APP_URL | INTEGRATION_REDIRECT_URI |
|---|
| Production | https://app.securatlas.com | https://app.securatlas.com/api/integrations/callback |
| Preview | https://preview.securatlas.com | https://preview.securatlas.com/api/integrations/callback |
| Development | http://localhost:3000 | http://localhost:3000/api/integrations/callback |
Vercel automatically injects NEXT_PUBLIC_VERCEL_URL in preview deployments. However, SecurAtlas uses NEXT_PUBLIC_APP_URL explicitly to ensure consistent OAuth redirects.