Secret keys shipped in the frontend in Supabase

Keep two variables, matching Supabase's own example:

NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=sb_publishable_...

SUPABASE_SECRET_KEY=sb_secret_...

Create the browser client with the publishable key. Create an admin client only in a file that is imported by server code, and never from a Client Component. If the secret key has already shipped, rotate it in Settings, then API Keys, and disable the legacy service_role key as well. Creating a new secret key does not revoke the old JWT-based key. Supabase's rotation steps say to replace every use first, then retire the compromised key.