Environment

import { loadEnv, publicEnv } from "better-supabase/env";

const env = loadEnv(); // reads process.env, throws EnvValidationError
const browser = publicEnv(env); // { url, publishableKey }, safe to ship

loadEnv() accepts the spellings frameworks use, the first one set wins:

What is checkedCopy Anchor Link

• The URL is https, or http on localhost, 127.0.0.1 or [::1] only.
• Keys use the new format: sb_publishable_… and sb_secret_…. Legacy eyJ… JWT keys are rejected with a pointer to the API Keys settings.
• A secret key in a publishable variable is an error, not a warning.
• SUPABASE_JWKS is JSON with at least one key that has a kty, read the way @supabase/server reads it.
• SUPABASE_JWT_SECRET has at least 32 characters. Only backend: 'lite' reads it.
• require: ['secretKey', 'dbUrl'] makes optional settings mandatory.
• SUPABASE_PUBLISHABLE_KEYS and SUPABASE_SECRET_KEYS must be JSON objects of key names to keys. All secret keys are kept in env.secretKeys (the single key is default), so a server can accept named keys.

Error messages name the variables and never include their values, so they are safe to log.

Standard SchemaCopy Anchor Link

envSchema() is the same validator as a Standard Schema, for t3-env, framework config or any other validator slot:

import { envSchema } from "better-supabase/env";

const result = await envSchema({ require: ["secretKey"] })[
  "~standard"
].validate(process.env);

With @supabase/serverCopy Anchor Link

toServerEnv(env) returns the SupabaseEnv that withSupabase({ env }) and the @supabase/server core functions take.