Vault Your Keys.
The checkpoint that keeps every key you'll use safe. You store your Supabase keys in Infisical, your vault, so they live in one secure place and never sit in a file or this chat. The vault is your safe store; the deploy step copies these into Vercel later. Want the full why behind vaults and the placeholder pattern? Read the Secrets Management primer and the hands-on Wire Your Secrets Manager build. Here, you vault them for the workshop.
- Keys in a vault your Supabase keys stored in Infisical, separate from your personal passwords, in one secure place you copy from later.
- A clean, safe project no real key sitting in any file on disk, so your repo is safe to commit, share, or screenshot.
- The keys-out-of-chat habit Claude scaffolds each secret with the PASTE_HERE placeholder; you type the real value into Infisical yourself, so it never goes through Claude.
Wire it with Claude.
Paste this into Claude Code. It sets up your vault with the placeholder pattern and walks you through storing your Supabase keys, without ever asking you to paste a real key into the chat.
How this card works.
At the top of this card is a setup prompt. Copy it, paste it into Claude, and Claude walks you through storing your keys safely, explaining each step as it goes. You read along. It only stops when there's something only you can do (paste a project ID, or type a real value into Infisical), and it tells you exactly what to do at those moments.
You don't have to read the rest of this card to succeed. Claude walks you through it live. Everything below is here for when you want to understand the why, plus a visual walkthrough deck for finding your Supabase keys.
Your checkpoint.
Your Supabase project (from the last step) has keys. Here you store them in Infisical, your vault, so they live in one secure place and never sit in a file or this chat. Think of the vault as your safe store: the deploy step (S5) copies these keys into Vercel, which is what your live app actually reads. Nothing reads the vault for you during the workshop, and that's fine.
Your Supabase keys stored safely in Infisical, with no real key sitting in any file.
Your keys are in your vault, and a scan of your files turns up no real key.
Paste your project ID, then type each real value into the Infisical web UI yourself.
This card is the checkpoint, kept tight for the day. For the full reasoning (why a vault, the placeholder pattern, and why real values stay out of your repo), read the Secrets Management primer and the step-by-step Wire Your Secrets Manager build.
What happens, step by step.
Confirm your vault, paste your project ID
4 minClaude checks you're signed in to Infisical, then asks you to confirm you have a project to store keys in. Every Infisical account comes with a default one (often called Example Project); that's fine, or you can make your own.
/projects/<this part>/ piece) and paste it to Claude. The project ID is just an identifier, not a secret, so it's safe to share. Claude needs it to know which vault to write to.
Claude creates the placeholders
3 minUsing your project ID, Claude creates a slot in your vault for each Supabase key, filled with the literal placeholder PASTE_HERE. No real values yet, and nothing sensitive in the chat. This is the scaffolding; you fill the real values next.
You fill in the real values
8 minClaude shows you exactly where your three Supabase values live (the walkthrough deck up top shows each screen). You then open each placeholder in the Infisical web UI and paste the real value there yourself, so it never passes through Claude or a file.
PASTE_HERE; you type the real value straight into Infisical. If Claude offers to enter a key for you, say no. Don't create a project .env or .env.local with real values.
Prove nothing leaked
3 minClaude scans your repo to confirm there's no real key, token, or .env file with real values sitting on disk. That's the checkpoint.
Where to find your Supabase keys.
Your Supabase project already exists from the last step. Claude already set your API URL for you (it isn't a secret, and Claude knows it from the connector), so here you only grab the two keys and paste them into the placeholders Claude created. Heads up: the first time, the keys are a bit of an easter egg hunt, because Supabase shows two different key systems. Use the Legacy API keys tab, not the newer Publishable and Secret one.
The visual walkthrough deck shows each screen: where the Legacy API keys tab is, which key is which, and how the URL is handled for you. The anon public key fills SUPABASE_ANON_KEY and NEXT_PUBLIC_SUPABASE_ANON_KEY; the service_role secret key (click Reveal) fills SUPABASE_SERVICE_ROLE_KEY and bypasses Row Level Security, so keep it private. Your API URL is already set for you.
You hand-fill two keys across three placeholders: the anon key goes under two names, service_role under one. Your API URL is already set under both URL names. Full mapping:
| In Supabase | Vault secret name(s), same value under each |
|---|---|
| API URL (set for you by Claude) | SUPABASE_URL, NEXT_PUBLIC_SUPABASE_URL |
| anon public key | SUPABASE_ANON_KEY, NEXT_PUBLIC_SUPABASE_ANON_KEY |
| service_role secret key | SUPABASE_SERVICE_ROLE_KEY |
service_role as a real secret: never paste it into chat, a file, or a commit.Going to the 8D room?
Want a local tool or scheduled job to actually read a vaulted key on its own? That's the 8D Infisical Agent path, set up with /upgrade-8d-secrets. Plus live tracing on every agent action. Start at Trace Every Agent Action.