Skip to main content
API keys and secrets are among the most common sources of security breaches. Noah helps you manage credentials securely so they never end up exposed in your frontend code.

​
Why API Key Security Matters

Noah generates frontend code that runs in the browser. Any API key or secret hardcoded in client-side code is visible to anyone who inspects the page. Exposed credentials can lead to:
  • Unauthorized API usage — Attackers can use your keys to make requests at your expense
  • Data breaches — Exposed database credentials can expose all your user data
  • Financial loss — Leaked wallet keys or payment credentials can lead to direct fund theft

​
How Noah Protects Your Secrets

Noah follows a secure-by-default approach for handling credentials:

​
Automatic Detection

When you paste an API key or secret in the chat, Noah will guide you to store it securely instead of embedding it in your code.

​
Secure Storage

Noah uses environment variables and Supabase secrets to store credentials:
  • Environment variables — Stored securely, accessible only server-side
  • Supabase secrets — Managed through the Cloud tab, encrypted at rest

​
Server-Side Execution

For operations that require API keys, Noah generates Supabase Edge Functions to keep credentials server-side:
  1. Your frontend calls the Edge Function
  2. The Edge Function reads the secret securely
  3. The API call happens server-side
  4. Only the result is returned to the frontend

​
Setting Up Secrets

1

Open Cloud Settings

In your project, click the Cloud tab in the toolbar
2

Navigate to Secrets

In the left sidebar, click Secrets
3

Add Your Secret

Add your API key or credential with a descriptive name (e.g., OPENAI_API_KEY, STRIPE_SECRET_KEY)
4

Use in Edge Functions

Reference secrets in your Edge Functions using Deno.env.get('SECRET_NAME')

​
What Should Be a Secret?

Store as Secret ✅Safe in Frontend ❌→✅
API keys (OpenAI, Stripe, etc.)Supabase anon key (designed for frontend use)
Database passwordsPublic API endpoints
Private wallet keysApp configuration (non-sensitive)
OAuth client secretsPublic content or metadata
Webhook signing secrets
Third-party service tokens
Never paste private wallet keys or seed phrases into Noah’s chat. If you need wallet functionality, use Noah’s built-in wallet creation tools or Supabase Edge Functions.

​
Common Patterns

​
Using an External API Securely

Instead of this (insecure): 
Add an AI chat feature using my OpenAI key: sk-abc123...
Do this (secure): 
Add an AI chat feature that calls OpenAI. Store the API key as a secret 
and call it through a Supabase Edge Function.
Noah will:
  1. Create a Supabase Edge Function for the API call
  2. Guide you to store your key in Secrets
  3. Wire up the frontend to call the Edge Function

​
Webhook Verification

Create a webhook endpoint that verifies Stripe signatures using 
the webhook signing secret stored in Supabase secrets.

​
Third-Party Integrations

Integrate with the Coingecko API to fetch token prices. 
Keep the API key server-side using an Edge Function.

​
Best Practices

Instead of pasting API keys directly, describe what you want to build. Noah will set up the secure integration for you.
Any API call that requires credentials should go through a Supabase Edge Function, not the frontend.
If you suspect a key has been exposed, regenerate it immediately and update it in your secrets.
Keep separate API keys for development and production environments to limit the blast radius of any exposure.
Ask Noah: “Check my code for any hardcoded API keys or secrets” to scan for accidentally exposed credentials.

​
FAQ

Noah will detect it and guide you to store it securely. However, you should still regenerate the key from the provider’s dashboard as a precaution.
Yes. Secrets stored through Supabase are encrypted at rest and only accessible server-side through Edge Functions.
For local development, yes. But for deployed apps, use Supabase secrets to ensure credentials are never bundled in your frontend build.