| Type | Prefix | Use |
|---|---|---|
| Publishable key | sb_publishable_ | Safe to expose in the browser (old anon) |
| Secret key | sb_secret_ | Server only, bypasses RLS (old service_role) |
| Legacy tab | eyJ... (JWT) | Old anon / service_role, still works |
service_role moved to the Legacy tab. Current path: Settings → API Keys → Secret keys.
The anon key can't write to Storage, and it invites a misdiagnosis
Writes fail with new row violates row-level security policy, but listing buckets returns an empty array with no error. It looks like "there are no buckets," not a permissions problem.
Warning
Secret / service_role is a master key that bypasses all RLS. Server env vars only; never in the frontend or a public repo.