Postgres best practices
Supabase API keys: which key goes where, and what to do when one leaks
The anon key (or the newer publishable key) is meant to be public and is safe only because RLS protects your tables. The service_role key (or the newer secret key) bypasses RLS completely and must never reach a browser, a mobile app or a public repo. If it does, rotate it at once and check your logs for what it did.
Last updated
What is the difference between the keys?
- Publishable key (`sb_publishable_...`) or legacy anon key: low privilege. It maps to the anon role, and to the authenticated role once a user signs in. Safe in the browser if RLS is right.
- Secret key (`sb_secret_...`) or legacy service_role key: full access that skips RLS. Use it only in server code, Edge Functions and background jobs.
How do service keys leak in AI-built apps?
- An environment variable named with a public prefix such as `NEXT_PUBLIC_` or `VITE_`, which the bundler puts into client JavaScript.
- A prompt that asks the AI to "make the query work" when RLS blocks it, and the AI swaps in the service key.
- A key pasted into a chat, a screenshot or a committed `.env` file.
# Search your build output for a secret key before you deploy.
grep -rE "sb_secret_|service_role" dist/ .next/static/ build/ 2>/dev/nullWhat do I do if my service key leaked?
- Rotate it now in the Supabase dashboard under API keys. With the new keys, create a new secret key and delete the old one; with legacy JWT keys, rotate the JWT secret.
- Update every server that used the old key.
- Check your API logs for requests made with the old key from networks you do not run, especially bulk selects and deletes.
- Check your tables for changes you did not make.
Frequently asked questions
- Is it safe to put the anon key in my frontend?
- Yes, that is its purpose. It is safe only if every table it can reach has correct RLS policies.
- Can I tell if someone is using my service key?
- Supabase API logs record each request. Supahound learns which networks your service key normally comes from and alerts you when it shows up from a new network or a browser.
- Should I move to the new publishable and secret keys?
- Yes for new projects. You can create and revoke secret keys one at a time, which makes rotation after a leak much less painful than rotating the JWT secret.