Supabase is retiring anon and service_role keys: what to change

Supabase is replacing anon and service_role keys with sb_publishable_ and sb_secret_. What to change, which header to use, and what to rotate.

The short version

Supabase is replacing its two old keys with two new ones:

Old key	New key	Safe in your app's frontend?
`anon` (a long `eyJ...` token)	`sb_publishable_...`	Yes
`service_role` (also `eyJ...`)	`sb_secret_...`	Never

Supabase says it is deprecating anon and service_role "by the end of 2026" (Supabase API keys docs). New projects stopped getting the legacy keys in November 2025 (Supabase GitHub announcement).

Why it matters to you

A secret key (sb_secret_ or service_role) "bypasses Row Level Security". Anyone who holds it can read and write your whole database (docs).
A publishable key is fine to ship in your app. However, your data is only as safe as your RLS policies.
Creating new keys does not turn off your old ones. Both keep working until you disable the old ones under Settings → API Keys (docs).

Step by step

In the Supabase dashboard, open Settings → API Keys. If you see Create new API keys, click it. This is safe; your old keys keep working (migration guide).
Frontend (Lovable, Bolt, v0 and so on): replace the anon key with the sb_publishable_... key. It usually lives in VITE_SUPABASE_ANON_KEY / VITE_SUPABASE_PUBLISHABLE_KEY or NEXT_PUBLIC_....
Backend only (Edge Functions, API routes): use sb_secret_.... Edge Functions get it as SUPABASE_SECRET_KEYS (migration guide).
If you call Supabase with your own fetch, send the new keys in the apikey header only. If you also put the key in Authorization: Bearer, Supabase rejects the request with "Invalid JWT" (migration guide).
Check the "last used" indicators in the dashboard. Once nothing uses the old keys, disable them (JWT signing keys docs).
If a secret or service_role key was ever in your frontend code, treat it as leaked and rotate it now.

A related change

Since 8 April 2026, Supabase no longer returns your database's API schema to anon-key requests (Supabase changelog). This is good for you because attackers can no longer list your tables that way. It does not replace RLS: anyone who guesses a table name can still query it.

Quick self-check

Search your live site's JavaScript for sb_secret_ and service_role. If either one shows up, rotate the key today.

Scan your app free

ShipLatch checks your live site for leaked keys, public env values, source maps and exposed files. The $29 Fix Pack gives you fix prompts written for your app and re-scans that prove each fix worked.

Scan free at shiplatch.com → See the Fix Pack · $9 playbook

Want the whole pre-launch process in one place? Get App Security for Vibe Coders, our $9 PDF playbook.