# Ensure publishable/secret API keys are rotated periodically

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103899910178-ensure-publishablesecret-api-keys-are-rotated-periodically
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the project's publishable and secret API keys are replaced on a regular schedule, and immediately if a key may have been exposed. Old keys should be deleted after every application and service has switched to the new key, so that a leaked key stops working.

**Rationale**

Secret keys give full access to the project and bypass Row Level Security. Keys can leak through source code, logs, CI systems, or former team members. Rotating them regularly limits how long a leaked key can be used. The new key system lets you create a new key alongside the old one, so rotation can be done without downtime.

**Impact**

-   Limits how long a leaked key can be used
    
-   Removes access for anyone holding an old key
    
-   Every service using the key must be updated
    

**Default Value**

By default, API keys do not expire and are never rotated automatically.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   A list of every service and app that uses each key
    
-   A defined rotation schedule
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Project Settings and select API Keys.
    
4.  Open the Publishable and secret API keys tab.
    
5.  Check each key and confirm it was created or rotated within your rotation period.
    
6.  If any key is older than your rotation period, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Project Settings and select API Keys.
    
4.  Open the Publishable and secret API keys tab and create a new key of the same type.
    
5.  Replace the old key with the new key in every app and service that uses it.
    
6.  Confirm that everything works with the new key.
    
7.  Delete the old key. This cannot be undone.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Project Settings and select API Keys.
    
4.  If a service fails, update it to use the new key.
    
5.  If the old key has not been deleted yet, switch the service back to it until the issue is fixed.
    

**Reference**

-   [https://supabase.com/docs/guides/getting-started/api-keys](https://supabase.com/docs/guides/getting-started/api-keys)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.