Environment variables
Copy .env.example to .env and fill in your values. .env is gitignored;
never commit real secrets. The Supabase keys use the new key format
(sb_publishable_… / sb_secret_…) — the old anon/service_role keys are
deprecated and stop working at the end of 2026.
Local / app variables
Section titled “Local / app variables”| Variable | Scope | Purpose |
|---|---|---|
VITE_SUPABASE_URL | client + server | Shared dev project URL (movement-mapping-dev) — same for every branch, see below |
VITE_SUPABASE_PUBLISHABLE_KEY | client + server | Publishable key (sb_publishable_…), safe on the client |
SUPABASE_SECRET_KEY | server only | Secret key (sb_secret_…) for the service-role client; never exposed to the browser |
SUPABASE_ACCESS_TOKEN | local CLI | Personal access token so scripts/supa can link to the project |
SUPABASE_PROJECT_REF | local CLI | The shared dev project ref (e.g. movement-mapping-dev) |
SUPABASE_DB_PASSWORD | local CLI | DB password used when linking for supa db push |
SITE_URL | app | Base URL used to build auth redirect links and the sign-in link in invitation emails |
VITE_DOCS_URL | client | Public URL of the documentation site, used for the Docs link in the app header |
RESEND_API_KEY | local CLI + server | Optional. Configures Resend as the project’s custom SMTP provider (see Branching & deployment); also read at runtime by the app to send org-invitation emails directly via the Resend API |
SMTP_SENDER_EMAIL | local CLI + server | Required alongside RESEND_API_KEY. Sending address on a domain verified in Resend |
SMTP_SENDER_NAME | local CLI + server | Optional. Display name for outgoing emails (defaults to “Movement Mapping Tool”) |
MAINTENANCE_PURGE_SECRET | server (Render) | Shared secret checked against the x-maintenance-secret header on POST /api/maintenance/purge (the orphan-data purge sweep). Set identically on the network-mapping-app web service and the network-mapping-purge cron job (render.yaml) — this endpoint has no user session, so the secret is the only guard |
scripts/supa auto-manages SUPABASE_BRANCH_REF and VITE_SUPABASE_BRANCH_REF
— do not set these by hand. They’re currently always unset: per-git-branch
Supabase branches are disabled because the org is on the free plan, which
doesn’t support Preview Branching. See
Branching & deployment for the full story
and the plan to re-enable this on Pro.
CI / shared secrets
Section titled “CI / shared secrets”Set in CI, never as developer-local values: SUPABASE_DEV_PROJECT_REF,
SUPABASE_PROD_PROJECT_REF, SUPABASE_DEV_DB_PASSWORD,
SUPABASE_PROD_DB_PASSWORD, and the Render service secrets.
SUPABASE_ACCESS_TOKEN is used both locally (to link to the shared dev
project) and in CI (to apply/promote migrations).