Replit secrets and who can read them in Supabase
highUpdated Oct 14, 2026
If the repl uses Supabase, enable RLS and keep the secret key in an environment variable the browser bundle does not contain. Supabase says the publishable key is the client key only when RLS and grants are on.
Fix for Supabase
If the repl uses Supabase, enable RLS and keep the secret key in an environment variable the browser bundle does not contain. Supabase says the publishable key is the client key only when RLS and grants are on.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.