Secrets
Do not commit secret values. This document names required secrets only.
Supabase Edge Secrets
| Secret | Used By | Purpose |
|---|---|---|
SUPABASE_URL | all functions | Supabase project URL |
SUPABASE_SERVICE_ROLE_KEY | all functions | Server-side database access |
SUPABASE_ANON_KEY | Vercel-to-Edge execution | Public API key for function calls |
ANTHROPIC_API_KEY | Fathom ingest, interview synthesis, Drive OCR | Extraction, synthesis, and scanned/image text recovery |
FATHOM_API_KEY | fathom-sync, fathom-webhook | Fathom REST API |
FATHOM_WEBHOOK_SECRET | fathom-webhook | Signed webhook verification |
ASANA_API_KEY | asana-sync, asana-act | Asana REST API |
ASANA_ACT_WRITES_ENABLED | asana-act | External write operator switch |
TOGGL_API_KEY | toggl-sync | Toggl API and Reports API |
GDRIVE_SA_JSON / GOOGLE_DRIVE_JSON | drive-sync, calendar-sync, calendar-act, gmail-sync | Google service account JSON |
GOOGLE_CALENDAR_SUBJECT | calendar-sync, calendar-act | Optional Workspace impersonation subject for domain-wide delegation |
GOOGLE_GMAIL_SUBJECT | gmail-sync | Required explicit mailbox for read-only domain-wide delegation |
CALENDAR_ACT_WRITES_ENABLED | calendar-act | External Calendar write operator switch |
HUBSPOT_SERVICE_KEY | hubspot-sync | HubSpot API |
VOYAGE_API_KEY | drive-sync, fathom-sync, search | Voyage voyage-4 chunk embeddings and rerank-2.5 search reranking |
SPINE_MCP_TOKEN | spine-mcp, cma-admin | Interactive-agent reads and approval proposals; no board delivery |
SPINE_MCP_STAGE_TOKEN | spine-mcp, cma-admin | Independent read-only report/staging credential |
SPINE_MCP_LEARNING_TOKEN | spine-mcp, cma-admin | Independent reads + prompt_update proposals credential |
SPINE_MCP_ORCHESTRATOR_TOKEN | spine-mcp, Trigger | Independent readiness, persistence, and delivery credential |
SPINE_ORG_ID | spine-mcp | Required tenant pin when the database contains multiple organizations |
REPORT_REQUIRED_CONNECTORS | spine-mcp, Trigger | Optional readiness/refresh set override; values must match exactly |
FATHOM_WEBHOOK_SECRET is set in Supabase.
Vercel Env Vars
| Variable | Purpose |
|---|---|
SABLE_MODE | Set production for client-facing instances to disable demo fallbacks |
PUBLIC_APP_ORIGIN | Canonical app origin for smoke tests and operator handoff |
SUPABASE_URL | Web API Supabase access |
SUPABASE_SERVICE_ROLE_KEY | Web API service role access |
SUPABASE_ANON_KEY | Calls from Vercel API to Edge Functions |
NEXT_PUBLIC_SUPABASE_URL | Browser auth client config returned by /api/config |
NEXT_PUBLIC_SUPABASE_ANON_KEY | Browser auth client config returned by /api/config |
ANTHROPIC_API_KEY | /api/chat, upload OCR fallback, legacy CMA demo routes |
APP_TOKEN | Legacy token-gated demo fallback |
VOYAGE_API_KEY | Upload ingest, /api/search, and /api/chat retrieval with Voyage voyage-4 + rerank-2.5 |
Docs Search Env Vars
Hosted Docusaurus search is optional. Add all three to the docs deployment to show the search box:
| Variable | Purpose |
|---|---|
DOCSEARCH_APP_ID | Algolia DocSearch app ID |
DOCSEARCH_API_KEY | Public DocSearch search key, not an admin key |
DOCSEARCH_INDEX_NAME | Docs index name |
Operator Switches
External writes must be guarded. Current write switches:
ASANA_ACT_WRITES_ENABLED=true
CALENDAR_ACT_WRITES_ENABLED=true
Leave each unset unless the team is ready for approved proposals to become real external writes.
Trigger.dev Report Variables
| Variable | Purpose |
|---|---|
SUPABASE_URL, SUPABASE_ANON_KEY, CRON_SECRET | Invoke scheduled connector and CMA Edge entry points |
SUPABASE_SERVICE_ROLE_KEY | Persist Trigger run state; server-side only |
SPINE_MCP_ORCHESTRATOR_TOKEN | Persist and deliver validated drafts through the governed MCP contract |
SABLE_REPORT_DELIVERY_MODE | Required fail-closed switch: shadow or live |
SABLE_ORG_SLUG | Required when more than one organization exists |
ASANA_WORKSPACE_GID | Required explicit workspace for the scheduled Asana refresh |
BOARD_RECIPIENTS remains locked in Supabase. Shadow mode sends only to the first configured address.