Every Supabase key, what it does, and which ones can be public

Supabase is an open-source backend for developers that provides a database, authentication, and file storage. Recently, there has been concern over the various keys associated with Supabase and their implications for application security.

There are four types of keys used in Supabase: sb_publishable_, sb_secret_, anon, and service_role. The sb_publishable_ key is meant to be used on the frontend and is safe to expose. It identifies the project and works in conjunction with row-level security (RLS) to control access. On the other hand, the sb_secret_ key should never be exposed to the browser. It provides full access to the entire database and bypasses RLS, making it a severe security risk if discovered by an attacker.

The anon and service_role keys are legacy versions that have been deprecated. The anon key provides low-level access and is intended for use in browsers, while the service_role key offers slightly higher privileges and is also deprecated. Both keys are JWTs (JSON Web Tokens) that authenticate requests, and they should never be included in JavaScript bundles or client-side code.

Supabase announced that legacy keys will be retired by late 2026, and new projects will not have access to the anon and service_role keys. If your application was created before November 2025, it may still be using the legacy keys, and you must migrate to the new keys before the deadline to avoid your app breaking.

The primary concern with these keys is not their theft but their exposure. Exposing the sb_publishable_ or sb_secret_ keys in a browser can lead to unauthorized access to your database. While the new key format makes it easier to differentiate between the keys, it is still essential to ensure that only the appropriate keys are used in the correct context. By properly configuring row-level security and avoiding the exposure of sensitive keys, you can maintain a secure Supabase application.