UnbreakMyApp / Fix guides

Supabase Edge Function fails because a secret is missing

Your edge function returns 500 or "undefined" errors because an API key or secret was never set in production. How to find and fix it.

Why it happens

Edge Functions read API keys with Deno.env.get("NAME"). If that secret was never added to your Supabase project, the value is undefined, and the call to Stripe, OpenAI, Resend or another service fails, often with a vague 500 error in your app.

Local and production secrets are separate. Locally, functions read supabase/functions/.env. In production you must set secrets in the Dashboard (Edge Function Secrets) or with the CLI. A key that works in development can be missing live.

Other common slips: a typo or different capitalization in the secret name, or trying to name your secret with the SUPABASE_ prefix, which is reserved for the variables Supabase injects automatically (like SUPABASE_URL).

How to fix it, step by step

1. Open Supabase → Edge Functions → your function → Logs (or Invocations). Look for errors such as "undefined", "missing API key" or 401s from the outside service.
2. Search the function code for Deno.env.get( and write down every secret name it needs.
3. Go to Edge Functions → Secrets in the Dashboard and compare. Add any missing secret with the exact same name (names are case-sensitive).
4. Or use the CLI: supabase secrets set STRIPE_SECRET_KEY=sk_live_... and confirm with supabase secrets list.
5. You do not need to redeploy. Supabase says functions read a new secret immediately. Call the function again and check the logs.
6. Do not create your own secrets starting with SUPABASE_. Use the built-in SUPABASE_URL and key variables Supabase already provides.
7. Add a clear check at the top of the function so a missing secret returns a readable error (without printing the value).

Paste-ready prompt for Lovable

One of my Supabase Edge Functions is failing. Please:
1. List every Edge Function and every Deno.env.get() secret name each one uses.
2. For each function, add a check at the start: if a required secret is missing, return a 500 JSON error naming the missing variable (never print its value).
3. Tell me exactly which secret names I must add in Supabase → Edge Functions → Secrets.
4. Make sure no custom secret name starts with SUPABASE_ (that prefix is reserved), and use the built-in SUPABASE_URL / key variables instead of hardcoded values.
Do not hardcode any keys in the code.

FAQ

Sources

• https://supabase.com/docs/guides/functions/secrets
• https://supabase.com/docs/guides/functions/logging