# Connect Supabase

Supabase powers two things: the **Supabase write tools** and the optional **shared cloud layer** for org collaboration. Personal work stays local by default — connecting Supabase does not move your local data to the cloud.

## Set the values

Press **⌘K** and set each one:

- `SUPABASE_URL` — your project URL, e.g. `https://xxxx.supabase.co`
- `SUPABASE_SERVICE_ROLE_KEY` — server-side service-role key (never exposed to the browser)
- `SUPABASE_ANON_KEY` — public anon key (search `supabase anon`)

All are stored encrypted in the secrets vault.

## Shared cloud readiness

The shared cloud layer activates when **both** `SUPABASE_URL` and `SUPABASE_SERVICE_ROLE_KEY` are present. It is independent of `MADARX_AUTH_MODE` — publishing works while auth stays `local`. Nothing is uploaded implicitly: an artifact only reaches the cloud when you explicitly publish it, and every publish is audited.

Apply the cloud schema with the Supabase CLI or dashboard (`supabase/migrations/0001_shared_layer.sql`). See `supabase/README.md`.

## Verify

**Settings → Connectors** shows Supabase connectors as **ready** once the keys resolve.

## Related

- [Set an API key](/help/set-api-key)
- [Secrets vault overview](/help/secrets-vault-overview)
