Supabase

How it works

The Supabase integration pushes one ApiVault environment into a Supabase project's Edge Function secrets. Functions see a changed secret as soon as the sync finishes; nothing needs redeploying. Syncing runs on the same triggers as Vercel: key changes when auto-sync is on, the retry sweep, and Sync now.

Connecting Supabase

On Integrations, click Connect Supabase. Supabase asks you to choose one organization and approve ApiVault's access to its projects and secrets, then sends you back to the project's Supabase page. To sync to projects in another organization, click Connect Another Organization; each organization gets its own connection.

Linking a Supabase project

Click Add Project on the connection, choose the Supabase project, then choose the ApiVault environment it receives. ApiVault suggests one from the project's name — prod → Production, staging → Staging, dev → Development — when your keys use that environment. A Supabase project receives exactly one environment; link separate Supabase projects for production and staging. Paused projects cannot be linked until you restore them. To send a different environment later, choose Change environment in the link's ⋯ menu; the next sync deletes the secrets the new environment does not contain.

What ApiVault changes in Supabase

Supabase does not record who created a secret, so ApiVault keeps its own list of the secrets it created for each link and only ever updates or deletes those. If a secret you created yourself has the same name as a key, ApiVault skips the key and reports a conflict; delete or rename your secret in Supabase, then click Sync now. Supabase allows at most 100 secrets per project, not counting its built-in SUPABASE_ secrets; keys beyond that are reported as over limit.

A key's name is used as the secret name exactly. Names must start with a letter or underscore, contain only letters, digits and underscores, and must not start with SUPABASE_, which Supabase reserves. Keys with other names are skipped and listed in the sync's issues.

Access, custom vault keys and removal

Projects with a custom vault key work as they do for Vercel: auto-sync is off, and Sync now asks for the key. If the organization stops authorizing ApiVault, the connection shows Access lost, its links show Action needed and owners and admins are notified; click Reconnect to resume. Revoking ApiVault in Supabase does not delete the secrets it created.

Unlink deletes the secrets ApiVault created in that Supabase project, then removes the link; Disconnect unlinks every project and then revokes ApiVault's access, unless another ApiVault project is still connected to the same organization: Supabase would revoke that project's access too, so the authorization stays until the last one disconnects. If the Supabase project was deleted, the link is removed right away. If the connection lost access, the secrets cannot be deleted and Remove anyway lists the ones left in Supabase. The statuses match Troubleshooting by status, with Supabase in place of Vercel.