Questions about Brazilian payment provider (Efi)

[aabnoguera]

Hi,

I'm integrating a Brazilian payment provider (Efi/Pix) whose API requires mutual TLS. Before committing to an architecture, I need to confirm four things about Edge Functions in production (not local CLI).

1. OUTBOUND mTLS
   Is Deno.createHttpClient({ cert, key }) available in deployed Edge Functions? It's an unstable Deno API that normally requires the --unstable-http flag, and I understand the Edge Runtime doesn't expose a way to set Deno flags. If it isn't available, is there any supported way to present a client certificate on an outbound fetch?

2. INBOUND mTLS
   Is there any way to require a client certificate on requests arriving at an Edge Function — i.e. to make the TLS handshake fail when the caller presents no certificate?

Context for why I'm asking: the provider verifies my endpoint by first sending a request with no client certificate, which my server must reject at the TLS layer. Only if it's rejected does the real callback follow. Validating a header inside the function isn't enough, since by then the connection has already been accepted.

Does attaching a custom domain to an Edge Function change anything here, or does TLS still terminate on Supabase infrastructure?

3. EGRESS IP
   Is the outbound IP of an Edge Function stable, or does it vary per invocation and region? Is there any static egress IP option? The provider may require IP allowlisting.

4. SECRETS SIZE
   Is there a size limit on project secrets / environment variables? I'd need to store a base64-encoded PEM certificate and private key (a few KB each).

Thanks.

[k1ng-arthur]

I don't know the answer to 1) and 2) but i personally haven't come across any functionality for custom certificates in edge functions.

3. I don't believe that egress IP's can be stable. Here is a Supabase article on that along with some suggestions https://supabase.com/docs/guides/troubleshooting/why-supabase-edge-functions-cannot-provide-static-egress-ips-for-whitelisting-3d78b0
4. The maximum secret size is 48kib https://supabase.com/docs/guides/functions/limits so you should be good on that