supabase / cli / 27863571335
65%
develop: 65%

LAST BUILD BRANCH: gh-readonly-queue/develop/pr-5642-893960a6e9fae412eb0215afae05f1348e356e62
DEFAULT BRANCH: develop
Ran
Jobs 1
Files 227
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 64.939%. Remained the same
27863571335

push

github

web-flow 
feat(cli): add --reveal flag to projects api-keys (#5633)

## What changed

Adds an opt-in `--reveal` boolean flag to `supabase projects api-keys`
(native TS legacy shell).

When set, the command sends `reveal=true` to `GET
/v1/projects/{ref}/api-keys` so the Management API returns the full
secret keys (`sb_secret_...`) in `api_key` instead of redacting them to
`null`. The redacted values then render as `******` across all output
formats. With `--reveal`, the populated `api_key` flows through every
format (text table, `--output json`/`yaml`/`toml`/`env`, and the TS
`--output-format json`/`stream-json` envelope) — no formatter changes
were needed since masking is purely null-based.

## Why

Redaction is server-side: new secret keys come back `null` unless the
request carries `reveal=true`, and the command never sent it. Users had
no way to retrieve secret keys via the CLI, breaking
CI/preview-environment flows that scrape keys (e.g. `--output
json`/`env`) to populate service env vars. The same `reveal=true`
mechanism was already used internally by other flows
(link/bootstrap-adjacent) — it just wasn't exposed on this command.

Fixes #4775.

## Reviewer context

- **Opt-in, default unchanged.** The `reveal` query param is omitted
entirely when the flag is absent, keeping the default request
byte-identical to the Go CLI.
- **`bootstrap` is unaffected.** It shares `legacyGetProjectApiKeys` but
calls it without the flag and only consumes the never-redacted anon key,
so it stays on the default path.
- **Scope: native TS only.** The Go CLI (`apps/cli-go`) is intentionally
not touched; the flag is recorded as a TS-only divergence in
`docs/go-cli-porting-status.md`.
- **Telemetry:** `--reveal` is a boolean, so its value is logged
verbatim by the instrumentation (consistent with all other boolean
flags); the secret key values are never logged, cached, or written to
disk.

10752 of 16557 relevant lines covered (64.94%)

7.37 hits per line

Coverage Regressions

Lines Coverage ∆ File
2
80.61
 0.0% internal/storage/rm/rm.go
Jobs
ID Job ID Ran Files Coverage
1 27863571335.1 227
64.94
 GitHub Action Run
Source Files on build 27863571335