Dashboard → Edge Functions → Secrets (Manage secrets). The functions are multi-environment: both values are comma-separated lists, so one Supabase project serves local, staging, and prod at once without reconfiguring.
Required
REPLYBOX_SSO_SHARED_SECRETScomma-separatedOne secret per env — e.g. <local>,<staging>,<prod>. A request is accepted if it matches any.
REPLYBOX_ALLOWED_CALLBACKScomma-separatedEach env's callback — e.g. http://localhost:8000/api/v1/auth/utopia/callback,https://staging-api…/callback,https://api…/callback
Optional — defaults are fine
REPLYBOX_SSO_TICKET_TTL_SECONDSdefault 120Ticket lifetime.
REPLYBOX_SSO_TS_TOLERANCE_SECONDSdefault 300Signature timestamp tolerance.
How envs stay isolatedEach ReplyBox env sends its own callback (UTOPIA_SSO_CALLBACK_URL) and signs with its own secret (UTOPIA_SSO_SHARED_SECRET); the issue function only honors callbacks on the allowlist, and verify accepts any secret on the list.
Legacy single-value vars REPLYBOX_SSO_SHARED_SECRET / REPLYBOX_CALLBACK_URL still work as a fallback if you only run one environment.
SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY, SUPABASE_ANON_KEY are injected by the platform automatically — do not add them.
After changing secrets, redeploy the functions (or use the dashboard's redeploy) so they pick up the new values.