Reference
Environment Variables
Every environment variable Kredal uses, where it is read, and safety rules.
Configuration lives in kredal-app/.env.local (gitignored). The template is
kredal-app/.env.local.example.
Required
| Variable | Scope | Used by | Notes |
|---|---|---|---|
NEXT_PUBLIC_SUPABASE_URL | Public | Browser + server Supabase clients | Project API URL. |
NEXT_PUBLIC_SUPABASE_ANON_KEY | Public | Browser + server Supabase clients | Safe to expose; RLS protects data. |
SUPABASE_SERVICE_ROLE_KEY | Secret | Server only (src/lib/supabase/admin.ts) | Bypasses RLS. Never prefix with NEXT_PUBLIC_; never import into client components. |
Optional
| Variable | Scope | Purpose |
|---|---|---|
GEMINI_API_KEY | Secret, server only | Enables the AI layer (document extraction, consistency flags, narrative drafts). Absent → AI features are skipped silently. See Configure AI extraction. |
GEMINI_MODEL | Server only | Override the default gemini-2.0-flash. |
NEXT_PUBLIC_SITE_URL | Public | Canonical site URL for metadata/OG images (falls back to the Vercel production URL). |
Rules
- The
NEXT_PUBLIC_prefix makes a variable available in the browser bundle. Only the URL and anon key may carry it. - The service-role key is loaded through
src/lib/supabase/admin.ts, which is marked server-only; importing it from a client component throws at build time. - To populate these from the CLI without leaking them, see Rotate Supabase keys.
- When deploying, set the same three variables in the host (Vercel) — see Deploy to Vercel.