Configuration setup
Version: 1.0.0
Route: .streamlit/secrets.toml (not an in-app screen)
Who can access: deployers / maintainers
What this page does
Explains the secrets required for production login, Tracked Products (Supabase), and Shopify publish/sync.
Steps
-
Copy the example file:
cp .streamlit/secrets.toml.example .streamlit/secrets.toml -
Fill each block below.
-
Restart Streamlit (
streamlit run app.py). -
Sign in with the
[app_login]credentials.
Streamlit Cloud
Paste the same TOML blocks under App settings → Secrets. Do not commit secrets.toml.
Secrets reference
[app_login] (required)
| Key | Purpose |
|---|---|
username | Dashboard login |
password | Dashboard password |
Use
[app_login], not[auth]— Streamlit reserves[auth].
[supabase] (Tracked Products)
| Key | Purpose |
|---|---|
url | Project URL https://….supabase.co |
key | Service role key |
[shopify]
| Key | Purpose |
|---|---|
store_url | your-store.myshopify.com |
client_id | Dev Dashboard client ID |
client_secret | Dev Dashboard client secret |
api_version | Optional, default 2024-10 |
access_token | Optional legacy Admin API token |
Required Admin API scopes: read_products, write_products, read_inventory, write_inventory, read_locations.
Environment fallbacks
APP_USERNAME, APP_PASSWORD, SUPABASE_URL, SUPABASE_KEY, SHOPIFY_STORE_URL, SHOPIFY_CLIENT_ID, SHOPIFY_CLIENT_SECRET, SHOPIFY_ACCESS_TOKEN, SHOPIFY_API_VERSION.
Keep Supabase free tier from pausing
Add the same SUPABASE_URL and SUPABASE_KEY as GitHub Actions secrets so .github/workflows/supabase-keepalive.yml can ping the DB every 3 days. Local/manual check: python scripts/supabase_keepalive.py. The Streamlit app also sends a throttled keep-alive when you are logged in.
Errors & edge cases
- Missing login block → login page configuration error.
- Missing Supabase → Tracked Products warns and stops loading.
- Missing Shopify → publish/sync buttons disabled or inactive.
- Demo Mode needs no secrets — see Demo mode.