Description
Ensure the project uses the new publishable (sb_publishable_) and secret (sb_secret_) API keys, and that the legacy JWT-based anon and service_role keys are disabled. All apps, Edge Functions, CI pipelines, and integrations should be moved to the new keys before the legacy keys are turned off.
Rationale
The legacy anon and service_role keys are long-lived JWTs that cannot be rotated on their own without also rotating the JWT secret and breaking every client. The service_role key gives full access that bypasses Row Level Security. Supabase is deprecating these keys, and the new keys can be created, rotated, and deleted independently without downtime.
Impact
Removes long-lived JWT-based keys from use
Allows keys to be rotated without downtime
Any client still using a legacy key will stop working
Default Value
By default, older projects have only the legacy anon and service_role keys, and newer projects have both key types. Legacy keys stay active until you disable them.
Pre-Requisites
Project Owner or Admin role
A list of every place that uses the anon or service_role key
Test Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Project Settings and select API Keys.
Open the Legacy API keys tab.
Verify that the legacy anon and service_role keys are disabled.
If they are still active, follow the implementation steps.
Implementation Steps
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Project Settings and select API Keys.
Open the Publishable and secret API keys tab and create the new keys if they do not exist.
Replace the anon key with the publishable key, and the service_role key with a secret key, in every app and service.
Open the Legacy API keys tab and disable the legacy keys.
Backout Plan
Sign in to the Supabase Dashboard at https://supabase.com/dashboard.
Select your project.
Open Project Settings and select API Keys.
Open the Legacy API keys tab and re-enable the legacy keys.
Reference