Rotate Supabase Keys

Fetch Supabase API keys with the CLI and write them into .env.local without leaking them.

.env.local holds three Supabase values. This runbook fetches them safely — the guiding rule is never print a key to the terminal or transcript; pipe it straight into the file that consumes it.

The three values

Variable	Sensitivity
`NEXT_PUBLIC_SUPABASE_URL`	Public — safe to show.
`NEXT_PUBLIC_SUPABASE_ANON_KEY`	Public by design (RLS protects data).
`SUPABASE_SERVICE_ROLE_KEY`	Secret. Bypasses RLS. Server-only.

Write the URL

cd kredal-app
sed -i.bak "s|^NEXT_PUBLIC_SUPABASE_URL=.*|NEXT_PUBLIC_SUPABASE_URL=https://<project-ref>.supabase.co|" .env.local && rm -f .env.local.bak

Write the anon key (without printing it)

ANON_KEY=$(supabase projects api-keys --project-ref <project-ref> --output json \
  | jq -r '.[] | select(.name=="anon") | .api_key')
sed -i.bak "s|^NEXT_PUBLIC_SUPABASE_ANON_KEY=.*|NEXT_PUBLIC_SUPABASE_ANON_KEY=${ANON_KEY}|" .env.local && rm -f .env.local.bak

Write the service-role key (without printing it)

SERVICE_KEY=$(supabase projects api-keys --project-ref <project-ref> --reveal --output json \
  | jq -r '.[] | select(.name=="service_role") | .api_key')
sed -i.bak "s|^SUPABASE_SERVICE_ROLE_KEY=.*|SUPABASE_SERVICE_ROLE_KEY=${SERVICE_KEY}|" .env.local && rm -f .env.local.bak

Verify without revealing values

awk -F= '{ if ($1 ~ /^(NEXT_PUBLIC_SUPABASE_URL|NEXT_PUBLIC_SUPABASE_ANON_KEY|SUPABASE_SERVICE_ROLE_KEY)$/) print $1": set, length="length($2) }' .env.local

You should see all three set with plausible lengths (URL ~40, anon ~208, service ~219).

Rules

Do not run supabase projects api-keys and let it print to the terminal in a shared session — an automated safety layer will (correctly) block writing keys to disk via an intermediate file or printing them. Go straight into .env.local.
.env.local is gitignored — confirm with git check-ignore -v kredal-app/.env.local.
After rotating the service-role key in the dashboard, update any deployment (Vercel) env vars too.