Would it be safe to place secrets in route handlers/edge functions?

[rose umbra]

I have a project using Supabase for auth, and I want to give users the option to delete their own account. The only way to do this with Supabase is with admin authorization using the service key (dangerous, bypasses all security, client can never see it).

Are api routes/route handlers/edge functions ever exposed to the client?

I would want to have for example:
app/auth/delete-account/route.ts

I'm also a little confused on the difference between edge functions and route handlers.

[rustic coral]

Post created!

🔎 This post has been indexed in our web forum and will be seen by search engines so other users can find it outside Discord

🕵️ Your user profile is private by default and won't be visible to users outside Discord, if you want to be visible in the web forum you can add the "Public Profile" role in id:customize

✅ You can mark a message as the answer for your post with Right click -> Apps -> Mark Solution
(if you don't see the option, try refreshing Discord with Ctrl + R)

[river field]

Yes it is safe. The client only has access to the returned response, so as long as you don’t return new Response(accessToken) you should be fine