Call a Third-Party API Securely with Supabase Edge Functions
Some logic just doesn't belong on the client, like calling a payment API with a secret key. This mission gets a Supabase Edge Function running end to end, from your first deploy through calling it from real app code. You'll create a function, test it locally, pull in an npm package, and store a secret key the right way. You'll end with a working function that talks to a third-party service without ever exposing that key to your users.
Who this is for: Anyone with a Supabase project who needs to run backend logic, like calling a third-party API with a secret key, without standing up a separate server.
By the end, you'll have:
- A working edge function created and deployed straight from the Supabase dashboard
- The same function recreated locally with the CLI, linked to your project, and running in a local dev environment
- An npm package imported and used inside your function
- A secret key stored with Supabase secrets and read safely from inside the function, never exposed to the client
What you'll learn:
- How edge functions run on Deno and why that means most npm packages just work
- The difference between creating a function from the dashboard and managing it with the CLI
- How to run and test a function locally before deploying it
- How to store and read secret keys without ever putting them in your codebase
- How to call your deployed function from real app code using the Supabase client
The journey
3 objectives. One real outcome.
Objective 1
Create and Deploy Your First Edge Function
Create a function from the dashboard, then recreate it locally with the CLI and link it to your project.
Objective 2
Run Functions Locally and Add an npm Package
Serve your functions locally, confirm edits update live, then import an npm package.
Objective 3
Manage Secrets and Call a Third-Party API
Store a secret key safely, read it inside your function, deploy, and call it from real app code.
Frequently asked questions
Do I need Docker for this?
Yes, running functions locally requires Docker to be running in the background.
What language do edge functions use?
TypeScript, running on Deno, a modern JavaScript runtime that supports npm packages.
Where do secret keys go?
Into a local env file that's git ignored, then pushed to Supabase with the secrets command, never hardcoded in your function.
Can I test a function without deploying it?
Yes, the CLI can serve your functions locally so you can call them before they ever go live.
How do I call the function from my app?
Use the invoke method under the functions namespace on the Supabase client, or call it with a regular fetch.