All secrets and configuration values are managed through environment variables. In development, use a .env file. In production, configure them in Vercel project settings.
Required Variables
Supabase
| Variable | Used By | Description |
|---|
VITE_SUPABASE_URL | Frontend | Supabase project URL |
VITE_SUPABASE_ANON_KEY | Frontend | Supabase anonymous key (public) |
SUPABASE_URL | API functions | Supabase project URL (server-side) |
SUPABASE_SERVICE_ROLE_KEY | API functions | Service role key (admin access, never exposed) |
SUPABASE_ANON_KEY | API functions | Anon key for user-authenticated RPC calls |
Convex
| Variable | Used By | Description |
|---|
VITE_CONVEX_URL | Frontend + API | Convex deployment URL |
Anthropic (AI Generation)
| Variable | Used By | Description |
|---|
CLAUDE_API_KEY | API functions | Anthropic API key |
ANTHROPIC_API_KEY | API functions | Fallback key name |
OpenAI (Embeddings)
| Variable | Used By | Description |
|---|
OPENAI_API_KEY | API functions | OpenAI API key for embeddings |
Pinecone (Vector Search)
| Variable | Used By | Description |
|---|
PINECONE_API_KEY | API functions | Pinecone API key |
PINECONE_INDEX | API functions | Primary index name (1536-dim) |
PINECONE_INDEX_LARGE | API functions | Large index name (3072-dim) |
Resend (Email Delivery)
| Variable | Used By | Description |
|---|
RESEND_API_KEY | API functions | Resend API key for email sending |
Optional Variables
AWS SES (Fallback Email)
| Variable | Used By | Description |
|---|
AWS_ACCESS_KEY_ID | API functions | AWS credentials for SES |
AWS_SECRET_ACCESS_KEY | API functions | AWS secret key |
AWS_REGION | API functions | AWS region (e.g., us-east-1) |
Monitoring
| Variable | Used By | Description |
|---|
SENTRY_DSN | API functions | Sentry error tracking DSN |
Telegram Notifications
| Variable | Used By | Description |
|---|
TELEGRAM_BOT_TOKEN | API functions | Telegram bot token for admin notifications |
TELEGRAM_CHAT_ID | API functions | Telegram chat ID for notifications |
Security Notes
- Never commit
.env files to version control
- The
SUPABASE_SERVICE_ROLE_KEY has full database access — only use server-side
VITE_ prefixed variables are exposed to the frontend bundle — never put secrets here- The
SUPABASE_ANON_KEY is used in spendTokensServer() to create user-authenticated clients (not the service role key)