All secrets and configuration values are managed through environment variables. In development, use a .env file. In production, configure them in Vercel project settings.
Required Variables
Supabase
| Variable | Used By | Description |
|---|
VITE_SUPABASE_URL | Frontend | Supabase project URL |
VITE_SUPABASE_ANON_KEY | Frontend | Supabase anonymous key (public) |
SUPABASE_URL | API functions | Supabase project URL (server-side) |
SUPABASE_SERVICE_ROLE_KEY | API functions | Service role key (admin access, never exposed) |
SUPABASE_ANON_KEY | API functions | Anon key for user-authenticated RPC calls |
Convex
| Variable | Used By | Description |
|---|
VITE_CONVEX_URL | Frontend + API | Convex deployment URL |
Anthropic (AI Generation)
| Variable | Used By | Description |
|---|
CLAUDE_API_KEY | API functions | Anthropic API key |
ANTHROPIC_API_KEY | API functions | Fallback key name |
OpenAI (Embeddings)
| Variable | Used By | Description |
|---|
OPENAI_API_KEY | API functions | OpenAI API key for embeddings |
Pinecone (Vector Search)
| Variable | Used By | Description |
|---|
PINECONE_API_KEY | API functions | Pinecone API key |
PINECONE_INDEX | API functions | Primary index name (1536-dim) |
PINECONE_INDEX_LARGE | API functions | Large index name (3072-dim) |
Resend (Non-AMP Email Delivery)
| Variable | Used By | Description |
|---|
RESEND_API_KEY | API functions | Resend API key for non-AMP email sending |
EMAIL_FROM | API functions | Sender address for Resend (Kinetic Email <sean@kinetic.email>) |
Mailgun (AMP Email Delivery)
| Variable | Used By | Description |
|---|
MAILGUN_API | API functions | Mailgun API key for kinetic.email domain |
MAILGUN_WEBHOOK_SIGNING_KEY | API functions | HMAC-SHA256 key for webhook signature verification |
Optional Variables
Monitoring
| Variable | Used By | Description |
|---|
SENTRY_DSN | API functions | Sentry error tracking DSN |
Telegram Notifications
| Variable | Used By | Description |
|---|
TELEGRAM_BOT_TOKEN | API functions | Telegram bot token for admin notifications |
TELEGRAM_CHAT_ID | API functions | Telegram chat ID for notifications |
Security Notes
- Never commit
.env files to version control
- The
SUPABASE_SERVICE_ROLE_KEY has full database access — only use server-side
VITE_ prefixed variables are exposed to the frontend bundle — never put secrets here- The
SUPABASE_ANON_KEY is used in spendTokensServer() to create user-authenticated clients (not the service role key)