if i use my service role secret key in my backend within a .env it's safe to use, right?

Yes, just make sure that the file is not accessible from a browser.

will do , thank you!