Reference for local and Vercel configuration. Never commit secrets; use the platform env UI or .env.local (gitignored).
NEXT_PUBLIC_SUPABASE_URL — project URLNEXT_PUBLIC_SUPABASE_ANON_KEY — anon/public keyAPI_KEY_ENCRYPTION_SECRET — at least 16 characters; used server-side only for AES-256-GCM.
openssl rand -hex 32NEXT_PUBLIC_ — that exposes them to the browser bundle.