Unverified50% confidenceFactExact time
Supabase has two types of keys: the publishable key (formerly called anon) is intended for the browser and is constrained by row-level security, while the secret key (formerly called service_role) completely bypasses row-level security.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedSupabase's public anonymous key (anon key) is by design not a secret, is permitted to appear in frontend code, and only represents the identity of an 'unauthenticated user'.80% similarUnverifiedSupabase's anon key is by design publicly embedded in front-end code and does not itself constitute a security risk, provided that RLS policies are correctly configured.77% similarVerifiedBest practices for secure API Key storage include using the system-native keychain (macOS Keychain, Windows Credential Manager) or professional tools (1Password, HashiCorp Vault), and following the principle of least privilege with regular rotation.69% similarVerifiedPasskey is based on the W3C WebAuthn standard and the FIDO Alliance's FIDO2 specification, with asymmetric key encryption at its core, where the private key is securely stored on the device and never leaves it.66% similarUnverifiedSupabase's Row Level Security policies must be configured manually, and omitting them may lead to security risks involving unauthorized data access.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1002923API
curl https://kongchang.com/api/v1/knowledge/claims/1002923MCP
get_claim(id=1002923)