Three values to paste, then you're live.

Open this file in any text editor. At the top of the <script> block near the bottom you'll find the CFG section. Paste your keys between the quotes, save, and re-upload.

const CFG = {
  MAPBOX_TOKEN : "pk.eyJ1Ijoi...",      // Mapbox → Default public token
  SUPABASE_URL : "https://xxxx.supabase.co",  // Supabase → Settings → API → Project URL
  SUPABASE_ANON: "eyJhbGciOi..."        // Supabase → Settings → API → anon public
};

All three are safe in a public web page. The anon key is designed for it — your protection comes from the row-level security rules in schema.sql, which you run in Supabase first.