Supabase Credential Generator
Generates Supabase credentials locally that aren't possible to generate with random bytes in Railway natively.
Save the output before closing this page. Treat
SERVICE_ROLE_KEY,
SUPABASE_SECRET_KEY, and asymmetric
service-role keys as server-only credentials. Never expose
them in browser app code.
Options
Railway OAuth
Connect with Railway, choose the Supabase Studio service, then generate and add all credentials to that service. All services that use those credentials will be redeployed. Credentials are generated in this browser.
Proxy disclaimer: Your Railway OAuth token will pass through a Cloudflare Worker because Railway's API blocks browser requests. You cannot verify that a deployed worker matches its published source code or behaves legitimately. Only continue if you accept this risk.
Manage permissions in Railway connected apps. To clear this site's Railway session without revoking permissions, click .
Choose a project, its Supabase Studio service, then the target environment.
Not connected.
Railway variables
Generation logic
This page ports the logic from
docker/utils/generate-keys.sh and
docker/utils/add-new-auth-keys.sh to browser
JavaScript: random bytes replace openssl rand,
WebCrypto HMAC signs legacy HS256 JWTs, WebCrypto ECDSA
signs ES256 JWTs, and SHA-256 creates opaque key checksums.
Railway integration uses OAuth Authorization Code with PKCE
and Railway GraphQL variable and deployment mutations. No
third-party code runs on this page.