Use Squiid with
Lovable

What Lovable is

Lovable builds full stack web applications from a conversation in the browser. It generates a React frontend, wires up a backend and can publish the result, with a Supabase integration for data and authentication. It is the most literal expression of vibe coding, and the moment an app leaves the prototype stage it needs real services with real credentials behind it.

The problem: every agent wants keys

The moment a coding agent stops writing a component and starts wiring up a product, it needs credentials. A database URL for Supabase. A deploy token for Vercel. An API key for Resend. Another for Twilio, another for Stripe, another for whichever model provider the feature calls. Each one is a signup, a dashboard, a billing relationship and a secret that has to exist somewhere Lovable can reach.

What happens next is worse than a long .env file. People paste secrets into prompts to get better answers, and keys end up in chat transcripts, in screenshots posted for help, and in committed config. Because each key belongs to a different vendor, rotating one after a leak means finding it, regenerating it and updating every place it was copied to.

The fix: one key, one convention

Squiid holds the upstream credentials for every service in the catalog. Your project gets one variable:

SQUIID_API_KEY=sq_live_xxxxxxxxxxxxxxxxxxxx

Then every call your app or your agent makes goes to the gateway with that one key:

curl https://api.squiid.io/v1/supabase/... \
  -H "Authorization: Bearer $SQUIID_API_KEY"

Official SDKs take a base URL, so most integrations are a one line change rather than a rewrite:

import { createClient } from '@supabase/supabase-js';

const db = createClient(
  'https://api.squiid.io/v1/supabase',
  process.env.SQUIID_API_KEY,
);

That is the gateway convention: https://api.squiid.io/v1/<service>/ with Authorization: Bearer $SQUIID_API_KEY. It is the same for every service, which is why an agent only has to learn it once. Full detail is on the gateway convention page.

Setting it up in Lovable

• Lovable projects have an area for environment variables and secrets used by server side code and edge functions. Add SQUIID_API_KEY there rather than pasting provider keys into the chat.
• If you connect GitHub and sync the project to your own repository, the same single variable is all your local environment needs, which keeps the browser project and the repo in step.
• State the gateway convention in your prompt so generated server functions call api.squiid.io. Check the Lovable documentation for the current name of the secrets panel, since the product moves quickly.

Agent tooling changes quickly. Where a file path or a settings panel is named above, confirm it against the agent own current documentation before relying on it.

What it costs

Usage is paid from prepaid credits at par: $1 of credit is $1 at the provider, no markup. The free plan is $0/month with a 15% fee on credit top-ups and a $50 minimum top-up. Solo is $19.97/month and its top-up fee starts at 8%, falling to 6.5%, 5% and 3.5% as trailing 30-day API spend passes $100, $500 and $2,000. Team is $29.97 per seat per month for seats 1-5, $24.97 for seats 6-20 and $19.97 above that, with the same ladder one point lower. Custom pricing is 3% or less against a commitment. Subscription-priced services such as Supabase Pro at $25 a month pass through at the provider price with no fee. Credits pause at zero rather than overdrawing, with alerts at 75%, 90% and 100%. See spend controls.