diff --git a/.gitignore b/.gitignore
index 5ef6a52..cd01f46 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,6 +32,7 @@ yarn-error.log*
 
 # env files (can opt-in for committing if needed)
 .env*
+.env.local
 
 # vercel
 .vercel
diff --git a/src/lib/supabase.ts b/src/lib/supabase.ts
index dcb77c3..a2cc9fc 100644
--- a/src/lib/supabase.ts
+++ b/src/lib/supabase.ts
@@ -1,10 +1,23 @@
 import { createClient } from '@supabase/supabase-js';
 
-const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL || '';
-const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY || '';
+const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL as string;
+const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY as string;
+
+if (!supabaseUrl || !supabaseAnonKey) {
+  throw new Error('Missing Supabase environment variables');
+}
 
 export const supabase = createClient(supabaseUrl, supabaseAnonKey);
 
+// For server-side functions that need admin privileges
+export const getServiceSupabase = () => {
+  const serviceRoleKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
+  if (!serviceRoleKey) {
+    throw new Error('Missing service role key');
+  }
+  return createClient(supabaseUrl, serviceRoleKey);
+};
+
 export type Tables = {
   products: {
     id: string;