Step 7 · about 7 minutes

Keep keys out of your code

Where secrets actually go: a .env.local file your repo is told to ignore.

In your project folder make a file called .env.local — the dot at the start matters — and put your values in it, one per line:

Terminal

NEXT_PUBLIC_SUPABASE_URL=https://yourproject.supabase.co
NEXT_PUBLIC_SUPABASE_ANON_KEY=sb_publishable_…

Then make sure it can never be pushed. Check that .gitignore contains a line saying .env*.local, and prove it:

Terminal

# is Git ignoring it?
$ git check-ignore -v .env.local
.gitignore:34:.env*.local  .env.local
# an answer means yes. silence means NOT ignored