Secrets
Supabase and Firebase secrets, what each stores, and how to configure them.
Secrets are keys that never go in the app. They live on the server (Supabase Edge Functions or Firebase Cloud Functions).
See Edge Functions and Cloud Functions for which function uses each secret.
Full table
| Secret | Supabase | Firebase | Feature | Purpose |
|---|---|---|---|---|
STRIPE_SECRET_KEY | Yes | Yes | Stripe | Stripe API on server |
STRIPE_WEBHOOK_SECRET | Yes | Yes | Stripe | Webhook signature |
STRIPE_PRODUCT_ID | Yes | No | Stripe | Filter product (optional) |
REVENUECAT_WEBHOOK_KEY | Yes | Yes | RevenueCat | Webhook token |
META_ACCESS_TOKEN | Yes | Yes | Facebook / RC | Conversions API |
META_DATASET_ID | Yes | Yes | Facebook / RC | Pixel / dataset ID |
AI_API_KEY | Yes | Yes | AI Chat | OpenAI or Gemini |
AI_PROVIDER | Yes | No | AI Chat | openai or gemini |
AI_SYSTEM_PROMPT | Yes | No | AI Chat | System prompt (optional) |
MAPBOX_ACCESS_TOKEN | Yes | Yes | Drive | Maps and pricing |
DRIVE_* | Yes | No | Drive | Fare knobs (optional) |
FIREBASE_PROJECT_ID | Yes | No | Push (Supabase) | Companion Firebase project |
FIREBASE_SERVICE_ACCOUNT_JSON | Yes | No | Push (Supabase) | FCM service account JSON |
Supabase auto-injects SUPABASE_URL, SUPABASE_ANON_KEY, SUPABASE_SERVICE_ROLE_KEY.
Firebase push uses ADC, not FIREBASE_SERVICE_ACCOUNT_JSON on Cloud Functions.
Configure
supabase secrets set STRIPE_SECRET_KEY=sk_test_...
firebase functions:secrets:set STRIPE_SECRET_KEYRun kasy check (Supabase) or kasy doctor to see what's missing.
Last updated on 08/02/2026