{
  "id": 276748,
  "title": "Every Supabase key, what it does, and which ones can be public",
  "url": "https://urgent.news/2026/08/07/every-supabase-key-what-it-does-and-which-ones-can-be-public",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-07T19:16:15.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/thunkle/every-supabase-key-what-it-does-and-which-ones-can-be-public-3j0a"
  },
  "original_language": "en",
  "account": "Supabase is an open-source backend for developers that provides a database, authentication, and file storage. Recently, there has been concern over the various keys associated with Supabase and their implications for application security.\n\nThere are four types of keys used in Supabase: sb_publishable_, sb_secret_, anon, and service_role. The sb_publishable_ key is meant to be used on the frontend and is safe to expose. It identifies the project and works in conjunction with row-level security (RLS) to control access. On the other hand, the sb_secret_ key should never be exposed to the browser. It provides full access to the entire database and bypasses RLS, making it a severe security risk if discovered by an attacker.\n\nThe anon and service_role keys are legacy versions that have been deprecated. The anon key provides low-level access and is intended for use in browsers, while the service_role key offers slightly higher privileges and is also deprecated. Both keys are JWTs (JSON Web Tokens) that authenticate requests, and they should never be included in JavaScript bundles or client-side code.\n\nSupabase announced that legacy keys will be retired by late 2026, and new projects will not have access to the anon and service_role keys. If your application was created before November 2025, it may still be using the legacy keys, and you must migrate to the new keys before the deadline to avoid your app breaking.\n\nThe primary concern with these keys is not their theft but their exposure. Exposing the sb_publishable_ or sb_secret_ keys in a browser can lead to unauthorized access to your database. While the new key format makes it easier to differentiate between the keys, it is still essential to ensure that only the appropriate keys are used in the correct context. By properly configuring row-level security and avoiding the exposure of sensitive keys, you can maintain a secure Supabase application.",
  "summary": "I audit apps built with AI tools. Most of the exposed credentials I find are Supabase keys, and most of them are not a problem. That is the part people get wrong in both directions. Some panic about a key that was designed to be published. Others ship the one that grants full database access and never notice, because nothing breaks. There are four keys. Two of them are being retired. The deadline…",
  "key_points": [
    "Four types of Supabase keys: sbpublishable, sbsecret, anon, and servicerole",
    "sbpublishable key safe for frontend exposure, identifies project, works with RLS",
    "sbsecret key should never be exposed, provides full database access, bypasses RLS"
  ],
  "editors_take": null,
  "illustration": "https://urgent.news/ill/276748.png",
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}