Environment variables
Every variable name, its purpose, whether it is required, and where it is read. Names only; no secret values.
On this page
How to read this table
These are variable names and purposes only. No secret value, example or generated credential is published here. A required variable stops the backend at boot when it is missing; an optional variable falls back to a default. The source column identifies where the value is read. Runtime admin settings can override some of these values even when the environment is set.
Names below are verified from the example environment file and from the code paths that read them. The example file lists ten names; the code also reads names the example file does not list, such as FRONT_DOOR_PORT, PGBOUNCER_PORT and SUPABASE_MANAGER_ENV_FILE.
Core manager variables
| Name | Purpose | Required | Read by |
|---|---|---|---|
PORT | Manager API and WebSocket bind port, bound to 127.0.0.1. | Yes | Backend and launcher |
FRONTEND_URL | Allowed frontend origin for API CORS and the development proxy. | Yes | Backend and Vite proxy setup |
JWT_SECRET | Signs manager session tokens; at least 32 characters. | Yes | Session signing and verification |
VAULT_MASTER_KEY | Encrypts project and edge-function secrets; at least 32 characters. | Yes | Vault encryption |
ADMIN_EMAIL | Email address seeded for the first administrator. | Yes | First-boot admin seed |
ADMIN_PASSWORD | Password seeded for the first administrator. If empty, a password is generated on first boot. | No | First-boot admin seed |
Proxy and front door
| Name | Purpose | Default | Notes |
|---|---|---|---|
PROXY_PORT | Subdomain reverse proxy port. | 9000 | Can be overridden by an admin setting. |
PROXY_BASE_DOMAIN | Base domain for project subdomains. | lvh.me in code; the example file uses supa.localhost | Wildcard resolution is required. |
PROXY_ACCEPT_LVH_ME | Accept lvh.me as an additional suffix. | Off | Widens host routing; opt in deliberately. |
FRONT_DOOR_PORT | Path-routed entry port. | 6000 | Admin setting wins over the environment. |
Per-project ports and paths
| Name | Purpose | Required | Notes |
|---|---|---|---|
PORT_BAND_BASE | Port band base, validated by setup. | No | The allocator uses the constant 60000 and does not read this value. |
PORT_BLOCK_SIZE | Port block size, validated by setup. | No | The allocator uses 11 and does not read this value; the example file says 10. |
PGBOUNCER_PORT | Shared PgBouncer pooler port. | No | Default 6432. |
SUPABASE_WRAPPER_PROJECTS_ROOT | Restricts written project paths to a root directory. | No | Symlinks and paths outside the root are rejected. |
Advanced and development
| Name | Purpose | Notes |
|---|---|---|
VAULT_MASTER_KEY_PREVIOUS | Prior vault key retained after rotation. | Keeps older records decryptable. |
SUPABASE_MANAGER_ENV_FILE | Override the environment file path. | Useful for tests and multiple instances. |
VITE_BACKEND_PORT | Vite development proxy target. | Read when Vite starts; only relevant in development. |
NODE_ENV | Development or production mode. | Set by the launcher. |
Where the file lives
The backend loads my-supabase-app/.env at startup through dotenv, unless SUPABASE_MANAGER_ENV_FILE points elsewhere. The setup script writes the file with owner-only permissions. Vite reads its own environment from its working directory, which is why launching it from the wrong folder breaks the development proxy.