Edge Functions

Add server-side logic to your app. If your app needs a secret API key, a webhook handler, or server-side validation — you need an edge function.

What is an edge function?

A small piece of code that runs on a server, not in your app. Your app calls it like an API. The function does the sensitive work (calls OpenAI, charges a card, queries a database with admin permissions), then returns a clean result to your app.

You need one whenever:

• Your app uses a secret key that can't be shipped in the app bundle (sk-..., STRIPE_SECRET_..., anything with the word "secret" in the name)
• A webhook has to reach your code (Stripe payment confirmations, Paddle subscription events)
• You want server-side validation that the user can't bypass
• You're calling an API that requires a server origin (CORS-restricted APIs)

You don't need one for:

• Public API keys (Mapbox pk_..., Google Maps web key, Supabase anon key, Stripe publishable pk_...) — these are safe in the app bundle, read them from .env via the Env tab
• Calls to your own database — Supabase/Firebase SDKs handle auth client-side

Pick your backend

Huxly supports three providers. Different tradeoffs.

Setup: Supabase (recommended)

The easy path. Two clicks and you're done.

Step 1 — Connect Supabase

In Huxly's chat page, open the Database tab in the left sidebar. Pick Supabase. Paste two values from your Supabase project:

• Project URL — like https://xxxxx.supabase.co
• Anon key — long string starting with eyJ...

Both are on your Supabase dashboard → Project Settings → API.

Step 2 — Ask the AI for an edge function

Just describe what you want:

The AI generates:

• An edge function at supabase/functions/<name>/index.ts
• The app-side caller that invokes it

Step 3 — Add your API key as a secret

In Huxly's Edge Functions panel, click the Secrets tab. Add OPENAI_API_KEY (or whichever key the function needs) with your real value.

Step 4 — Click Deploy

Huxly pushes the function + secret to Supabase. Takes ~10 seconds. You're done.

Setup: Firebase (advanced)

Firebase Cloud Functions require a one-time IAM setup per project. Once done, future functions work without further configuration.

Step 1 — Make sure your Firebase project is on the Blaze plan

Cloud Functions require pay-as-you-go billing. The free tier is generous — most small apps stay free.

Open: Firebase Billing page for your project. If it says "Upgrade to Blaze" — click that. Add a billing account.

Step 2 — Connect Firebase to Huxly

Open Huxly's Database tab → pick Firebase. You'll need a service account JSON key from Google Cloud Console.

Paste the contents into Huxly's form. Done.

Step 3 — Enable Secret Manager API

Open the Secret Manager API page for your project. Click Enable. Wait 30 seconds for propagation.

Step 4 — Grant deploy permission

The deployer service account (firebase-adminsdk) needs permission to "act as" the runtime service account.

1. Open Service Accounts in Cloud Console
2. Click the row for <project-id>@appspot.gserviceaccount.com (App Engine default — this is the runtime)
3. PERMISSIONS tab → GRANT ACCESS
4. New principals: paste firebase-adminsdk-fbsvc@<project-id>.iam.gserviceaccount.com
5. Role: Service Account User
6. Save

Step 5 — Grant secret-read permission

The runtime needs permission to read secrets at startup.

1. Open IAM page in Cloud Console
2. Find the row for <project-id>@appspot.gserviceaccount.com
3. Click the pencil icon (edit roles)
4. ADD ANOTHER ROLE → search for Secret Manager Secret Accessor
5. Save

Step 6 — Wait 5 minutes

Google IAM caches take 5–15 minutes to fully propagate. Skipping this wait causes "operation in progress" loops.

Step 7 — Ask the AI for an edge function and create your secrets

Same as Supabase Step 2 — describe what you want and the AI generates both the function and the app-side caller.

For each secret the function declares:

1. Open Secret Manager
2. + CREATE SECRET
3. Name: exactly matching what the function uses (e.g. OPENAI_API_KEY)
4. Value: your actual key
5. Save

Step 8 — Click Deploy in Huxly

Huxly handles the rest automatically:

• Pre-flight check that all prerequisites are met
• Deploys the function via Google's Cloud Functions API
• Auto-grants public invoker permission so your app can call the function
• Smoke-tests the URL to confirm it's reachable

If anything is missing, you'll see a setup-required modal with the exact GCloud link to fix it.

Calling the function from your app

The AI generates the calling code for you, but here's what it should look like:

Supabase (Deno function)

import { supabase } from '@/lib/supabaseClient';

const { data, error } = await supabase.functions.invoke('analyzeFood', {
  body: { imageBase64, mimeType },
});

Firebase (Callable function)

import { getFunctions, httpsCallable } from 'firebase/functions';
import app from '@/lib/firebaseConfig';

const fn = httpsCallable(getFunctions(app), 'analyzeFood');
const { data } = await fn({ imageBase64, mimeType });

import { getAuth, signInAnonymously, onAuthStateChanged } from 'firebase/auth';

useEffect(() => {
  const auth = getAuth(app);
  return onAuthStateChanged(auth, (user) => {
    if (!user) signInAnonymously(auth).catch(console.error);
  });
}, []);

This is silent to end-users — no sign-up screen, no email/password.

Common errors → what to do

When deploy fails, Huxly shows a setup-required modal with the exact fix. Here's the reference if you want to know what each error means.

Updating a secret value

You don't need to redeploy the function to update a secret.

Supabase

Update the value in Huxly's Secrets tab → Save. Next function call picks up the new value.

Firebase

Update the value in Google Secret Manager:

1. Open the secret
2. Click + NEW VERSION
3. Paste the new value
4. Save

The function reads version: 'latest' so the next cold start picks up the new version. If your function has a warm instance running with the old value, redeploy to force a cold start.

Advanced mode

For users with existing complex Firebase setups (custom regions, custom service accounts, custom IAM policies, custom invoker configurations), Huxly's smooth-deploy enhancements can interfere.

In advanced mode, Huxly skips:

• Pre-flight IAM probes
• Auto-grant of allUsers invoker
• Smoke test ping

You get raw Cloud Functions API responses. Useful for diagnosing unusual setups or matching an existing deploy pipeline.

To enable: include advancedMode: true in the deploy request. UI toggle is planned for a future release.

Frequently asked

Can I call the function from outside my app (cURL, Postman)?

Supabase: yes, with the anon key as Authorization: Bearer <key>. Firebase: technically yes via raw POST, but the function's req.auth.uid check will reject calls without a valid Firebase auth token. Easier to test from your app.

How do I see logs?

Supabase: Edge Functions panel → click the function → Logs tab. Firebase: Cloud Console → Functions → click the function → Logs tab. Realtime, searchable, includes every invocation.

How much does it cost?

Supabase: free tier is 500K invocations/month. Beyond that, ~$2 per million.

Firebase: free tier is 2 million invocations/month, then $0.40 per million. Plus compute time (negligible for short functions).

Both providers have very generous free tiers — most apps stay free.

Can I have multiple functions?

Yes, unlimited. Each function is its own file. Huxly's panel lists them all and you can deploy them individually.

What if my function takes a long time (>30 seconds)?

Cloud Functions and Supabase Edge Functions both have configurable timeouts. For very long jobs (>1 minute), consider running them as a background task and returning a job ID the app can poll.