supabase/scripts/README.md

Supabase Vault Setup

This script populates the Supabase Vault with the service role key at deployment / local-dev time, eliminating the need to hardcode sensitive credentials in version-controlled migration files.

Prerequisites

• Python 3.8+
• supabase package: pip install supabase
• Supabase project URL and service role key

Usage

From environment variables

set SUPABASE_URL=https://your-project.supabase.co
set SUPABASE_SERVICE_KEY=eyJhbGciOiJIUzI1NiIs...
python supabase/scripts/setup_vault.py

Or using a .env file (loaded automatically if you have python-dotenv installed):

set SUPABASE_URL=https://YOUR_PROJECT_REF.supabase.co
set SUPABASE_SERVICE_KEY=your_service_role_key_here
python supabase/scripts/setup_vault.py

What it does

1. Upserts SUPABASE_SERVICE_ROLE_KEY into vault.secrets
2. Upserts the same key into internal_config.secrets (used by legacy triggers)

After rotating the service role key

If the service role key is rotated in the Supabase dashboard:

1. Update the value in your local .env or deployment secrets
2. Re-run this script to sync the new key to the vault
3. All triggers and edge functions will pick up the new key automatically