Unverified60% confidenceFactExact time
Supabase's public anonymous key (anon key) is by design not a secret, is permitted to appear in frontend code, and only represents the identity of an 'unauthenticated user'.
2
Sources
60%
Confidence
Long-term
Relevance
9/25/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedSupabase's anon key is by design publicly embedded in front-end code and does not itself constitute a security risk, provided that RLS policies are correctly configured.79% similarUnverified由于服务器不记录调用方身份的历史状态，单凭一串API Key字符串就足以代表完整的身份权限，Key一旦泄露即可被无限制滥用67% similarUnverifiedOnce an API Key is leaked, an attacker can make unlimited API calls from anywhere in the world as the key holder, and the server cannot distinguish legitimate calls from unauthorized ones.65% similarUnverifiedIn end-to-end encryption (E2EE), each user holds a key pair—the public key is used for encryption and the private key for decryption—and the private key never leaves the user's device.63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/950677API
curl https://kongchang.com/api/v1/knowledge/claims/950677MCP
get_claim(id=950677)