Environment Variables Reference for the Next.js Supabase SaaS Kit
Complete reference for all environment variables in the Next.js Supabase SaaS Kit, including Supabase, Stripe, email, and feature flag configuration.
This page documents all environment variables used by the Next.js Supabase SaaS Kit. Variables are organized by category and include their purpose, required status, and default values.
Environment File Structure
| File | Purpose | Git Status |
|---|---|---|
.env | Shared settings across all environments | Committed |
.env.development | Development-specific overrides | Committed |
.env.production | Production-specific settings | Committed |
.env.local | Local secrets and overrides | Git-ignored |
Priority order: .env.local > .env.development/.env.production > .env
Required Variables
These variables must be set for the application to start:
# Supabase (required)NEXT_PUBLIC_SUPABASE_URL=https://yourproject.supabase.coNEXT_PUBLIC_SUPABASE_PUBLIC_KEY=your-public-keySUPABASE_SECRET_KEY=your-service-role-key# App identity (required)NEXT_PUBLIC_SITE_URL=https://yourapp.comNEXT_PUBLIC_PRODUCT_NAME=Your ProductNEXT_PUBLIC_SITE_TITLE="Your Product - Tagline"NEXT_PUBLIC_SITE_DESCRIPTION="Your product description"Core Configuration
Site Identity
NEXT_PUBLIC_SITE_URL=https://example.comNEXT_PUBLIC_PRODUCT_NAME=MakerkitNEXT_PUBLIC_SITE_TITLE="Makerkit - Build SaaS Faster"NEXT_PUBLIC_SITE_DESCRIPTION="Production-ready SaaS starter kit"NEXT_PUBLIC_DEFAULT_LOCALE=en| Variable | Required | Description |
|---|---|---|
NEXT_PUBLIC_SITE_URL | Yes | Full URL with protocol |
NEXT_PUBLIC_PRODUCT_NAME | Yes | Product name shown in UI |
NEXT_PUBLIC_SITE_TITLE | Yes | Browser title and SEO |
NEXT_PUBLIC_SITE_DESCRIPTION | Yes | Meta description |
NEXT_PUBLIC_DEFAULT_LOCALE | No | Default language (default: en) |
Theme
NEXT_PUBLIC_DEFAULT_THEME_MODE=lightNEXT_PUBLIC_THEME_COLOR="#ffffff"NEXT_PUBLIC_THEME_COLOR_DARK="#0a0a0a"NEXT_PUBLIC_ENABLE_THEME_TOGGLE=true| Variable | Options | Default | Description |
|---|---|---|---|
NEXT_PUBLIC_DEFAULT_THEME_MODE | light, dark, system | light | Initial theme |
NEXT_PUBLIC_THEME_COLOR | Hex color | Required | Light theme color |
NEXT_PUBLIC_THEME_COLOR_DARK | Hex color | Required | Dark theme color |
NEXT_PUBLIC_ENABLE_THEME_TOGGLE | true, false | true | Allow theme switching |
Supabase Configuration
NEXT_PUBLIC_SUPABASE_URL=https://yourproject.supabase.coNEXT_PUBLIC_SUPABASE_PUBLIC_KEY=your-public-keySUPABASE_SECRET_KEY=your-service-role-keySUPABASE_DB_WEBHOOK_SECRET=your-webhook-secret| Variable | Required | Description |
|---|---|---|
NEXT_PUBLIC_SUPABASE_URL | Yes | Supabase project URL |
NEXT_PUBLIC_SUPABASE_PUBLIC_KEY | Yes | Public anon key |
SUPABASE_SECRET_KEY | Yes | Service role key (keep secret) |
SUPABASE_DB_WEBHOOK_SECRET | No | Webhook verification secret |
Legacy Key Names
If you're using a version prior to 2.12.0, use NEXT_PUBLIC_SUPABASE_ANON_KEY and SUPABASE_SERVICE_ROLE_KEY instead.
Authentication
NEXT_PUBLIC_AUTH_PASSWORD=trueNEXT_PUBLIC_AUTH_MAGIC_LINK=falseNEXT_PUBLIC_AUTH_OTP=falseNEXT_PUBLIC_AUTH_IDENTITY_LINKING=falseNEXT_PUBLIC_CAPTCHA_SITE_KEY=CAPTCHA_SECRET_TOKEN=NEXT_PUBLIC_DISPLAY_TERMS_AND_CONDITIONS_CHECKBOX=false| Variable | Default | Description |
|---|---|---|
NEXT_PUBLIC_AUTH_PASSWORD | true | Enable password auth |
NEXT_PUBLIC_AUTH_MAGIC_LINK | false | Enable magic link auth |
NEXT_PUBLIC_AUTH_OTP | false | Enable OTP auth |
NEXT_PUBLIC_AUTH_IDENTITY_LINKING | false | Allow identity linking |
NEXT_PUBLIC_CAPTCHA_SITE_KEY | - | Cloudflare Turnstile site key |
CAPTCHA_SECRET_TOKEN | - | Cloudflare Turnstile secret |
NEXT_PUBLIC_DISPLAY_TERMS_AND_CONDITIONS_CHECKBOX | false | Show terms checkbox |
Password Requirements
NEXT_PUBLIC_PASSWORD_REQUIRE_UPPERCASE=falseNEXT_PUBLIC_PASSWORD_REQUIRE_NUMBERS=falseNEXT_PUBLIC_PASSWORD_REQUIRE_SPECIAL_CHARS=falseNavigation and Layout
NEXT_PUBLIC_USER_NAVIGATION_STYLE=sidebarNEXT_PUBLIC_HOME_SIDEBAR_COLLAPSED=falseNEXT_PUBLIC_TEAM_NAVIGATION_STYLE=sidebarNEXT_PUBLIC_TEAM_SIDEBAR_COLLAPSED=falseNEXT_PUBLIC_SIDEBAR_COLLAPSIBLE_STYLE=iconNEXT_PUBLIC_ENABLE_SIDEBAR_TRIGGER=true| Variable | Options | Default | Description |
|---|---|---|---|
NEXT_PUBLIC_USER_NAVIGATION_STYLE | sidebar, header | sidebar | Personal nav layout |
NEXT_PUBLIC_HOME_SIDEBAR_COLLAPSED | true, false | false | Start collapsed |
NEXT_PUBLIC_TEAM_NAVIGATION_STYLE | sidebar, header | sidebar | Team nav layout |
NEXT_PUBLIC_TEAM_SIDEBAR_COLLAPSED | true, false | false | Start collapsed |
NEXT_PUBLIC_SIDEBAR_COLLAPSIBLE_STYLE | offcanvas, icon, none | icon | Collapse behavior |
NEXT_PUBLIC_ENABLE_SIDEBAR_TRIGGER | true, false | true | Show collapse button |
Feature Flags
NEXT_PUBLIC_ENABLE_THEME_TOGGLE=trueNEXT_PUBLIC_ENABLE_PERSONAL_ACCOUNT_DELETION=falseNEXT_PUBLIC_ENABLE_PERSONAL_ACCOUNT_BILLING=falseNEXT_PUBLIC_ENABLE_TEAM_ACCOUNTS=trueNEXT_PUBLIC_ENABLE_TEAM_ACCOUNTS_CREATION=trueNEXT_PUBLIC_ENABLE_TEAM_ACCOUNTS_DELETION=falseNEXT_PUBLIC_ENABLE_TEAM_ACCOUNTS_BILLING=falseNEXT_PUBLIC_ENABLE_NOTIFICATIONS=trueNEXT_PUBLIC_REALTIME_NOTIFICATIONS=falseNEXT_PUBLIC_ENABLE_VERSION_UPDATER=falseNEXT_PUBLIC_LANGUAGE_PRIORITY=application| Variable | Default | Description |
|---|---|---|
NEXT_PUBLIC_ENABLE_PERSONAL_ACCOUNT_DELETION | false | Users can delete accounts |
NEXT_PUBLIC_ENABLE_PERSONAL_ACCOUNT_BILLING | false | Personal subscription billing |
NEXT_PUBLIC_ENABLE_TEAM_ACCOUNTS | true | Enable team features |
NEXT_PUBLIC_ENABLE_TEAM_ACCOUNTS_CREATION | true | Users can create teams |
NEXT_PUBLIC_ENABLE_TEAM_ACCOUNTS_DELETION | false | Users can delete teams |
NEXT_PUBLIC_ENABLE_TEAM_ACCOUNTS_BILLING | false | Team subscription billing |
NEXT_PUBLIC_ENABLE_NOTIFICATIONS | true | In-app notifications |
NEXT_PUBLIC_REALTIME_NOTIFICATIONS | false | Live notification updates |
NEXT_PUBLIC_ENABLE_VERSION_UPDATER | false | Check for updates |
NEXT_PUBLIC_LANGUAGE_PRIORITY | application | user or application |
Billing Configuration
Provider Selection
NEXT_PUBLIC_BILLING_PROVIDER=stripeOptions: stripe or lemon-squeezy
Stripe
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...STRIPE_SECRET_KEY=sk_test_...STRIPE_WEBHOOK_SECRET=whsec_...| Variable | Required | Description |
|---|---|---|
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY | Yes (Stripe) | Publishable key |
STRIPE_SECRET_KEY | Yes (Stripe) | Secret key |
STRIPE_WEBHOOK_SECRET | Yes (Stripe) | Webhook signing secret |
Lemon Squeezy
LEMON_SQUEEZY_SECRET_KEY=your-secret-keyLEMON_SQUEEZY_STORE_ID=your-store-idLEMON_SQUEEZY_SIGNING_SECRET=your-signing-secret| Variable | Required | Description |
|---|---|---|
LEMON_SQUEEZY_SECRET_KEY | Yes (LS) | API secret key |
LEMON_SQUEEZY_STORE_ID | Yes (LS) | Store identifier |
LEMON_SQUEEZY_SIGNING_SECRET | Yes (LS) | Webhook signing secret |
Email Configuration
Provider Selection
MAILER_PROVIDER=nodemailerOptions: nodemailer or resend
Common Settings
EMAIL_SENDER="Your App <noreply@yourapp.com>"CONTACT_EMAIL=contact@yourapp.comResend
RESEND_API_KEY=re_...Nodemailer (SMTP)
EMAIL_HOST=smtp.provider.comEMAIL_PORT=587EMAIL_USER=your-usernameEMAIL_PASSWORD=your-passwordEMAIL_TLS=trueCMS Configuration
Provider Selection
CMS_CLIENT=keystaticOptions: keystatic or wordpress
Keystatic
NEXT_PUBLIC_KEYSTATIC_STORAGE_KIND=localNEXT_PUBLIC_KEYSTATIC_CONTENT_PATH=./contentKEYSTATIC_PATH_PREFIX=apps/webFor GitHub storage:
NEXT_PUBLIC_KEYSTATIC_STORAGE_KIND=githubNEXT_PUBLIC_KEYSTATIC_STORAGE_REPO=owner/repoKEYSTATIC_GITHUB_TOKEN=github_pat_...| Variable | Options | Description |
|---|---|---|
NEXT_PUBLIC_KEYSTATIC_STORAGE_KIND | local, cloud, github | Storage backend |
NEXT_PUBLIC_KEYSTATIC_CONTENT_PATH | Path | Content directory |
KEYSTATIC_PATH_PREFIX | Path | Monorepo prefix |
NEXT_PUBLIC_KEYSTATIC_STORAGE_REPO | owner/repo | GitHub repository |
KEYSTATIC_GITHUB_TOKEN | Token | GitHub access token |
WordPress
WORDPRESS_API_URL=https://your-site.com/wp-jsonSecurity Best Practices
- Never commit secrets: Use
.env.localfor sensitive values - Use CI/CD variables: Store production secrets in your deployment platform
- Rotate keys regularly: Especially after team member changes
- Validate in production: The kit validates configuration at build time
Common Pitfalls
- HTTP in production:
NEXT_PUBLIC_SITE_URLmust usehttps://in production builds. - Same theme colors:
NEXT_PUBLIC_THEME_COLORandNEXT_PUBLIC_THEME_COLOR_DARKmust be different. - Missing Supabase keys: The app won't start without valid Supabase credentials.
- Forgetting to restart: After changing environment variables, you may need to restart the development server.
- Wrong file for secrets: Put secrets in
.env.local(git-ignored), not.env(committed).
Related Topics
- Application Configuration - Core app settings
- Authentication Configuration - Auth setup
- Feature Flags - Toggle features
- Going to Production - Deployment checklist