One Server
English
Sign up

Log in

Log in to your One Server account.

Continue with GoogleContinue with GitHub

or with email

Forgot your password?

No account yet? Sign up

Sign up

One account for your database and deployments.

Add a card after signing up and your project runs right away. At the end of each month the base fee and usage past the allowances are charged. Full pricing

Continue with GoogleContinue with GitHub

or with email

Consent
See what you agree to
Purpose
Forming the service agreement
What is collected
None
How long it is kept
Until you close your account. Contract and payment records required by the Electronic Commerce Act are kept for 5 years
Your right to refuse
You may refuse to consent. However, if you refuse, you cannot sign up.
See what you agree to
Purpose
Signing up and managing your account, providing the service, billing, answering inquiries
What is collected
Email address, password (stored encrypted), organization name, access records and usage records
How long it is kept
Until you close your account. Records a law requires to be kept are kept for the period it sets
Your right to refuse
You may refuse to consent. However, if you refuse, you cannot sign up.
See what you agree to
Purpose
Sending news of new features, advance notice of price changes, and event news
What is collected
Email address
How long it is kept
Until you withdraw your consent
Your right to refuse
You may refuse to consent, and refusing places no restriction at all on signing up or using the service. You can withdraw your consent at any time after giving it.

Read them in full in the Terms and the Privacy Policy.

Already have an account? Log in

Docs

Environment variables

How to give a deployed app values such as API keys, when changes take effect, and names you cannot use.

Environment variables

Values your deployed app receives through process.env when it is built and run. Put values here that must not go into the repository, such as API keys or the addresses of outside services.

list_env_vars    the variables there are now. Sensitive values show only the last four characters
set_env_vars     save one or more. variables, or dotenv (a whole .env file)
remove_env_var   delete from one target (production or preview)

Where they apply

You choose with targets. production is deployments of the production branch, preview is every other branch. The same name can hold different values in each: a test key for previews, the real key for production. Only owners and admins can change production values.

When changes take effect

A changed value is used in builds from the next deployment on. Values baked into an existing build don't change. Apps that run as a server receive the new value the next time they start.

Names you can't use

PORT, HOST, HOSTNAME, HOME and names starting with BLACKWALL_ are used by the platform. Builds get CI=1 unless you set CI yourself (for example CI=false). Values the platform provides:

BLACKWALL_ENV              production or preview
BLACKWALL_URL              the address this deployment is served at (a host name)
BLACKWALL_GIT_COMMIT_SHA   the commit that was built
BLACKWALL_GIT_BRANCH       the branch that was built

Automatic variables

This project's address and keys are set without anything being saved, under the names Supabase uses (automatic in list_env_vars, the console's environment variables screen, oneend env ls). Where each is available (available_in) differs.

                                                           Available in
SUPABASE_URL, NEXT_PUBLIC_SUPABASE_URL                     Build and runtime   https://<ref>.<zone>
SUPABASE_ANON_KEY, NEXT_PUBLIC_SUPABASE_ANON_KEY,
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY                       Build and runtime   the publishable key (follows access rules)
SUPABASE_SERVICE_ROLE_KEY                                  Runtime only        the secret key (bypasses access rules; server code only)
DATABASE_URL, POSTGRES_URL                                 Production runtime  pooler 6543 (only while the password is kept)
DIRECT_URL                                                 Production runtime  direct 5432 (only while the password is kept)

Runtime is servers, middleware and functions. The service role key never goes to builds (the install and build commands, where the scripts of the packages an app depends on run). A variable saved under the same name is used instead, and a saved value goes to builds too. A preview of a git branch that has a database branch gets the branch's values. DATABASE_URL, POSTGRES_URL and DIRECT_URL go to production servers, middleware and functions (never builds or previews) only while a password made with reset_database_password { ref, keep_for_deploys: true } is kept (console: Database connection → Make new password → "Keep it for my production deploys"). Like the secret key, that connection reads every row. Make a new password without keep_for_deploys and it is no longer handed over. oneend env pull writes only the public ones to .env.local. A Vite app reads names with another prefix, such as VITE_SUPABASE_URL; save those yourself.

Sensitive values

A value saved with sensitive: true can never be read back afterwards. Use it for secret keys. Without sensitive, a variable whose name contains SECRET, TOKEN, PASSWORD, PRIVATE, DSN, DATABASE_URL or KEY_, or ends in _KEY, is saved as sensitive (sensitive_keys in the answer). Give sensitive: false to keep it readable. Values that are not sensitive are also stored encrypted. The only difference is whether they are shown again.

Values that reach the browser

Names that frameworks put into browser code, such as NEXT_PUBLIC_ and VITE_, end up in the build as they are, where anyone can see them. Never use such names for secret keys.