# Configure Environment (/en/docs/tanstack-start/configure-environment)

Let the template CLI write local Supabase connection values. Add provider
settings only when you configure the corresponding capability.

```bash
bunx supabase start
./coremvp env sync
./coremvp env list
```

Run from the cloned repository root after the
[first-run migration check](/en/docs/quickstart#verify-the-local-schema).
`env sync` updates ignored `.env.local`; `env list` reports redacted `set` or
`missing` status. It does not print credentials or prove connectivity.

## Generated local settings

| Variable                               | Available to       | Purpose                                             |
| -------------------------------------- | ------------------ | --------------------------------------------------- |
| `NEXT_PUBLIC_APP_URL`                  | Browser and server | Local app origin, normally `http://localhost:3000`. |
| `NEXT_PUBLIC_SUPABASE_URL`             | Browser and server | The running local Supabase API.                     |
| `NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY` | Browser and server | The local Supabase publishable key.                 |
| `SUPABASE_SECRET_KEY`                  | Server only        | Privileged Supabase operations after authorization. |
| `DATABASE_URL`                         | Server only        | Drizzle's local PostgreSQL connection.              |

Keep the values written by `env sync` together; mixing another project's URL,
key or database connection sends the app to different services. Never commit
`.env.local` or copy server credentials into a public variable.

## Read public settings

The Start repository deliberately retains its `NEXT_PUBLIC_*` names.
`vite.config.ts` exposes that prefix, and browser modules read explicit
`import.meta.env` properties:

```typescript title="src/lib/supabase/client.ts (excerpt)" interactive=false
const supabaseUrl = import.meta.env.NEXT_PUBLIC_SUPABASE_URL;
const supabasePublishableKey =
  import.meta.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY;
```

Use the existing browser client rather than constructing another client in
each component. Do not rename these inputs to `VITE_*` or use browser
`process.env` reads. Vite loads the public inputs during development and
embeds them into the production build; see its
[environment variable guide](https://vite.dev/guide/env-and-mode).

The server factory in `src/lib/supabase/server.ts` reads the same public
Supabase URL/key from `process.env` inside the current request. Database URLs,
payment provider credentials, email credentials and `SUPABASE_SECRET_KEY` stay
in server-only modules. The `NEXT_PUBLIC_` prefix makes a value public; it is never suitable
for a secret.

## Add capability settings

Keep provider setup with the task it enables:

* [Billing](/en/docs/billing) supplies the selected provider's credentials,
  offer mappings and local webhook-listener sequence. Public Stripe catalog IDs
  retain the existing `NEXT_PUBLIC_STRIPE_*` names.
* [Email Delivery](/en/docs/email/delivery) supplies `EMAIL_DELIVERY_MODE` and
  the mode-specific server settings. Development normally uses `mock`.
  Before email sends in Start's production Node runtime, configure explicit real
  or capture settings as described in that guide.
* [Configure OAuth Providers](/en/docs/authentication/oauth-providers)
  supplies the provider handoff and app callback. Local OAuth credentials must
  be supplied to local Supabase before it starts; `env sync` does not enable a
  provider or copy its credentials.

Restart `bun run dev` after changing `.env.local`. Rebuild after changing
public values used by the Node output. Follow the
[local build instructions](/en/docs/tanstack-start/run-locally#run-the-local-build)
for that separate process.

## Verify the running connection

Start the app with `bun run dev`, sign in and open `/dashboard`. Run the
[local Auth check](/en/docs/authentication/test-authentication) after cookie or
connection changes. If a key is missing, sync after Supabase starts and restart
the app. If keys are present but requests fail, check that the URL and key
belong to the same running project; do not print secrets into logs.

For hosted deployment, see the Start [hosted deployment status](/en/docs/deployment#tanstack-start-deployment-status).

## What's next

<Cards>
  <Card title="Run Locally" href="/en/docs/tanstack-start/run-locally" description="Start development or run the compiled Node output." />

  <Card title="Billing" href="/en/docs/billing" description="Connect a test catalog before exercising checkout." />

  <Card title="Authentication" href="/en/docs/authentication" description="Follow the native cookie and server-admission boundaries." />
</Cards>