Service Role Key (Supabase)
Glossary
The service role key (in new projects: secret key, prefix sb_secret_) is Supabase's master key: it bypasses every Row Level Security rule and may read, change, and delete any row. It belongs on the server only. If it ends up in frontend code, a NEXT_PUBLIC variable, or the browser bundle, any visitor can read and overwrite the entire database — no matter how well the rest of the app is secured.
Supabase gives you two kinds of keys: a public one bound to RLS (formerly “anon”, now “publishable” with the prefix sb_publishable_) and a private one that bypasses RLS (formerly “service_role”, now “secret” with the prefix sb_secret_). The public key may go into the frontend, it only sees what your RLS policies allow. The secret one never may, because it overrides every rule. This distinction is the single most common critical mistake in AI- and no-code-generated apps.
Where to find the keys: in the Supabase dashboard under Settings → API Keys. That page lists the new publishable and secret keys; on older projects the old anon and service_role keys sit in the tab for legacy keys. According to its docs, Supabase plans to retire the old keys by the end of 2026, with the exact date still to be confirmed. Important when switching: creating new keys does not revoke the old ones. They stay valid until you explicitly disable them there.
The typical path to a leak: a generator or tutorial puts the key into a variable prefixed NEXT_PUBLIC_ (Next.js) or VITE_ (Vite) — both get compiled straight into the shipped browser bundle. Anyone who opens the page and looks at the dev tools has the master key. From then on the database is open, no matter how strong the password is.
Check it yourself: the service role key belongs only in server-side code (API routes, server actions, edge functions) and in environment variables without a NEXT_PUBLIC/VITE prefix. Search the entire frontend bundle for “service_role” and “sb_secret_”. That is exactly the finding the decivo Scan surfaces, one of the results that puts an app straight onto “stop”.