docs: add Supabase Edge Function secrets sync guide

public/integrations/platforms/aws-secrets-manager.md

@@ -499,13 +499,6 @@ You first need to set up credentials to use for the sync, and then choose a sour
 
 ### Step 1: Set up your AWS credentials in Phase
 
-<Note>
-  Your credentials are kept secure with robust application-layer encryption.
-  Phase encrypts your credentials directly in the browser and only decrypts them
-  in memory to perform sync operations. Your credentials are never stored in
-  plaintext.
-</Note>
-
 1. Create an `AccessKey` via the AWS Console. See [Step 5](#step-5-create-access-keys) for instructions on creating the key. Note the `AccessKeyId` and `SecretAccessKey`.
 
 2. Go to **Integrations** from the sidebar and click on **Third-party credentials** in the integrations tab.

public/integrations/platforms/cloudflare-pages.md

@@ -69,13 +69,6 @@ Scroll down and click **Continue to summary**
 
 ### Save your credentials in Phase
 
-<Note>
-  Your credentials are kept secure with robust application-layer encryption.
-  Phase encrypts your credentials directly in the browser and only decrypts them
-  in memory to perform sync operations. Your credentials are never stored in
-  plaintext.
-</Note>
-
 1. Go to **Integrations** from the sidebar and click on **Third-party credentials** in the integrations tab.
 
 ![Go to integrations](/assets/images/platform-integrations/integrations-sidebar.png)

public/integrations/platforms/gitlab-ci.md

@@ -110,13 +110,6 @@ This feature is only available on GitLab if you have the Premium or Ultimate lic
 
 ### Store authentication credentials in Phase
 
-<Note>
-  Your credentials are kept secure with robust application-layer encryption.
-  Phase encrypts your credentials directly in the browser and only decrypts them
-  in memory to perform sync operations. Your credentials are never stored in
-  plaintext.
-</Note>
-
 1. Go to **Integrations** from the sidebar and click on **Third-party credentials** in the integrations tab.
 
 ![Go to integrations](/assets/images/platform-integrations/integrations-sidebar.png)

public/integrations/platforms/hashicorp-nomad.md

@@ -132,14 +132,6 @@ In the following screen you will be presented with a `Token Secret` which is the
 
 ### Store authentication credentials in Phase
 
-<Note>
-  Your credentials are kept secure with robust application-layer encryption.
-  Phase encrypts your credentials directly in the browser and only decrypts them
-  in memory to perform sync operations. Your credentials are never stored in
-  plaintext.
-</Note>
-
-
 1. Go to **Integrations** from the sidebar and click on **Third-party credentials** in the integrations tab.
 
 ![Go to integrations](/assets/images/platform-integrations/integrations-sidebar.png)

public/integrations/platforms/hashicorp-vault.md

@@ -199,13 +199,6 @@ Phase can automatically sync secrets to your Hashicorp Vault instance. First, yo
 
 ### Step 1: Set up your Vault credentials in Phase
 
-<Note>
-  Your credentials are kept secure with robust application-layer encryption.
-  Phase encrypts your credentials directly in the browser and only decrypts them
-  in memory to perform sync operations. Your credentials are never stored in
-  plaintext.
-</Note>
-
 1. Create a `role_id` and `secret_id` via the Vault CLI. See [Step 2](#step-2-setting-up-app-role-authentication-and-acl-policy) for instructions.
 
 2. Go to **Integrations** from the sidebar and click on **Add credentials** in the 'Service credentials' section

public/integrations/platforms/railway.md

@@ -50,13 +50,6 @@ Alternatively, if you do have a Railway Team you want to sync secrets to, please
 
 ### Store authentication credentials in Phase
 
-<Note>
-  Your credentials are kept secure with robust application-layer encryption.
-  Phase encrypts your credentials directly in the browser and only decrypts them
-  in memory to perform sync operations. Your credentials are never stored in
-  plaintext.
-</Note>
-
 1. Go to **Integrations** from the sidebar and click on **Third-party credentials** in the integrations tab.
 
 ![Go to integrations](/assets/images/platform-integrations/integrations-sidebar.png)

public/integrations/platforms/render.md

@@ -42,13 +42,6 @@ You can use Phase to sync secrets with your Render Services and Environment Grou
 
 ### Store authentication credentials in Phase
 
-<Note>
-  Your credentials are kept secure with robust application-layer encryption.
-  Phase encrypts your credentials directly in the browser and only decrypts them
-  in memory to perform sync operations. Your credentials are never stored in
-  plaintext.
-</Note>
-
 1. Go to **Integrations** from the sidebar and switch to the **Third-party credentials** tab. 
 
 ![Go to integrations](/assets/images/platform-integrations/render/integrations-creds.png)

public/integrations/platforms/supabase.md

@@ -0,0 +1,109 @@
+import { Tag } from '@/components/Tag'
+import { DocActions } from '@/components/DocActions'
+
+export const description = 'Integrate Phase with Supabase'
+
+<Tag variant="small">INTEGRATE</Tag>
+
+# Supabase Edge Functions
+
+You can use Phase to sync secrets to your Supabase project. The secrets are available to your Edge Functions at runtime.
+
+<DocActions />
+
+<Warning>
+  When you enable secret syncing, Phase becomes the source of truth for your
+  secrets. Phase overwrites or deletes the secrets on the target service.
+  Import your secrets into Phase before you continue.
+</Warning>
+
+### Prerequisites
+
+- Sign up for the [Phase Console](/quickstart) and [create an App](/console/apps#create-an-app).
+- Enable Server-side Encryption (SSE) for the App from the [Settings](/console/apps#settings) tab.
+
+## Step 1: Authentication
+
+### Create a Supabase access token
+
+1. Log in to your [Supabase Dashboard](https://supabase.com/dashboard). Click your avatar in the top right, then select **Account**.
+
+![Supabase account menu](/assets/images/platform-integrations/supabase/supabase-account-menu.png)
+
+2. Go to the [Access Tokens](https://supabase.com/dashboard/account/tokens) tab and click **Generate New Token**. Enter a descriptive name, select an expiry, and click **Generate token**. Copy the token. Supabase shows it only once.
+
+![Generate new token](/assets/images/platform-integrations/supabase/supabase-generate-token.png)
+
+<Note>
+  Supabase requires an expiry on new access tokens (up to 1 year with a custom
+  date). When the token expires, syncs fail with an authentication error.
+  Syncs resume after you update the stored credentials with a new token.
+</Note>
+
+### Store authentication credentials in Phase
+
+1. Go to **Integrations** in the sidebar. Then click **Third-party credentials** in the integrations tab.
+
+![Go to integrations](/assets/images/platform-integrations/integrations-sidebar.png)
+
+2. Click **Supabase**.
+
+![supabase-create-creds](/assets/images/platform-integrations/supabase/add-credentials-supabase-1.png)
+
+3. Enter your Supabase `Access Token` from the previous step. Enter a descriptive name and click **Save**.
+
+![supabase-input-creds](/assets/images/platform-integrations/supabase/add-credentials-supabase-2.png)
+
+Phase encrypts and saves your credentials. You can view and manage them under *Service Credentials* in the *Integrations* screen.
+
+## Step 2: Set up a secret sync
+
+1. Open your App in the Phase Console and go to the **Syncing** tab. Select **Supabase Edge Functions** in the 'Create a new Sync' menu.
+
+![create supabase sync](/assets/images/platform-integrations/supabase/create-sync-supabase-1.png)
+
+2. Select the credentials that you added in the previous step. Then click **Next**.
+
+![select supabase creds](/assets/images/platform-integrations/supabase/create-sync-supabase-2.png)
+
+3. Configure the source and destination for your secrets. Select an Environment from your App as the source. If you want to sync from a specific folder, set the Path. Then select a Supabase project from the dropdown and click **Create**.
+
+![configure supabase sync](/assets/images/platform-integrations/supabase/create-sync-supabase-3.png)
+
+4. Phase now syncs your secrets to the selected Supabase project automatically. You can manage the sync from the *Syncing* tab of your App or from the *Integrations* screen.
+
+![supabase sync card](/assets/images/platform-integrations/supabase/supabase-sync-card.png)
+
+<Note>
+  Supabase reserves secret names that start with `SUPABASE_`, for example
+  `SUPABASE_URL` and `SUPABASE_ANON_KEY`. Supabase manages these secrets for
+  every project. The sync does not delete them and does not push Phase secrets
+  with this prefix. The sync logs list the skipped keys.
+</Note>
+
+Synced secrets are available to your Edge Functions without a redeploy. To see them, open the **Edge Functions → Secrets** page in the Supabase Dashboard, or use the Supabase CLI:
+
+```fish
+supabase secrets list --project-ref <your-project-ref>
+```
+
+An Edge Function reads the synced secrets as environment variables:
+
+```ts
+Deno.serve(async () => {
+  const stripeKey = Deno.env.get('STRIPE_SECRET_KEY')
+
+  return new Response(
+    JSON.stringify({ stripeKeyIsSet: Boolean(stripeKey) }),
+    { headers: { 'Content-Type': 'application/json' } },
+  )
+})
+```
+
+<Note>
+  Supabase allows a maximum of 100 secrets per project. If a sync contains
+  more than 100 secrets, the sync fails before it writes changes to the
+  project. The sync logs show this error. The
+  [Edge Functions limits](https://supabase.com/docs/guides/functions/limits)
+  page lists all limits.
+</Note>

public/llms.txt

@@ -72,6 +72,7 @@
 - [integrations/platforms/vercel](https://docs.phase.dev/integrations/platforms/vercel.md)
 - [integrations/platforms/railway](https://docs.phase.dev/integrations/platforms/railway.md)
 - [integrations/platforms/render](https://docs.phase.dev/integrations/platforms/render.md)
+- [integrations/platforms/supabase](https://docs.phase.dev/integrations/platforms/supabase.md)
 - [integrations/platforms/jenkins](https://docs.phase.dev/integrations/platforms/jenkins.md)
 - [integrations/platforms/circleci](https://docs.phase.dev/integrations/platforms/circleci.md)
 - [integrations/platforms/aws-codebuild](https://docs.phase.dev/integrations/platforms/aws-codebuild.md)