Is there a way around adding the supabase anon key and url in client's browser?

[jkohlin]

I just realized that this supa-fly-stack is storing ['NODE_ENV', 'SUPABASE_URL', 'SUPABASE_ANON_PUBLIC'] in windows.env.
Is that really necessary? I'm not very keen on showing my database information at the client. Isn't that the whole idea with Remix, to be able to handle auth on the serverside?

Is there a way around this?

[rphlmr]

It's necessary for using supabase browser client in oauth callback ;)

It's fine, this is just a public key ;)
See https://supabase.com/docs/guides/database/api#api-url-and-keys

[rphlmr]

To add some precision, you can remove SUPABASE_ANON_PUBLIC only if you rely on email/password auth and handle features like "verify my email"/"forget password" on your own.