Environment Variables

Read environment variables from extension code. Public variables are injected at build time — secrets are backend-only and never enter the bundle.

Read a variable

requireEnv throws if the variable is missing. Use it for required values. env returns an empty string if missing — use it for optional flags.

import { env, requireEnv } from "@/shared/lib/env";

const apiUrl = requireEnv("SUPABASE_URL");       // throws if missing
const optionalFlag = env("PUBLIC_FEATURE_FLAG");  // "" if missing

Secrets in extension code

Never read secret variables from extension code. If a value is a provider secret (Stripe key, AI key, Resend key), call a Supabase Edge Function instead — it reads the secret from Deno.env.get() server-side.

For the full environment variables system (local vs production, public vs secret, the four generated files), see the Environment Variables page.