# Ensure legacy anon/service_role API keys are not still in use

- Source: https://support.icompaas.com/support/solutions/articles/a_1790103900314771-ensure-legacy-anonservice_role-api-keys-are-not-still-in-use
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Supabase cloud](https://support.icompaas.com/support/solutions/c_1790103054038308) › [supabase checks](https://support.icompaas.com/support/solutions/folders/f_1790103067540538)
- Last updated: 2026-09-22
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the project uses the new publishable (sb\_publishable\_) and secret (sb\_secret\_) API keys, and that the legacy JWT-based anon and service\_role keys are disabled. All apps, Edge Functions, CI pipelines, and integrations should be moved to the new keys before the legacy keys are turned off.

**Rationale**

The legacy anon and service\_role keys are long-lived JWTs that cannot be rotated on their own without also rotating the JWT secret and breaking every client. The service\_role key gives full access that bypasses Row Level Security. Supabase is deprecating these keys, and the new keys can be created, rotated, and deleted independently without downtime.

**Impact**

-   Removes long-lived JWT-based keys from use
    
-   Allows keys to be rotated without downtime
    
-   Any client still using a legacy key will stop working
    

**Default Value**

By default, older projects have only the legacy anon and service\_role keys, and newer projects have both key types. Legacy keys stay active until you disable them.

**Pre-Requisites**

-   Project Owner or Admin role
    
-   A list of every place that uses the anon or service\_role key
    

**Test Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Project Settings and select API Keys.
    
4.  Open the Legacy API keys tab.
    
5.  Verify that the legacy anon and service\_role keys are disabled.
    
6.  If they are still active, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Project Settings and select API Keys.
    
4.  Open the Publishable and secret API keys tab and create the new keys if they do not exist.
    
5.  Replace the anon key with the publishable key, and the service\_role key with a secret key, in every app and service.
    
6.  Open the Legacy API keys tab and disable the legacy keys.
    

**Backout Plan**

1.  Sign in to the Supabase Dashboard at [https://supabase.com/dashboard](https://supabase.com/dashboard).
    
2.  Select your project.
    
3.  Open Project Settings and select API Keys.
    
4.  Open the Legacy API keys tab and re-enable the legacy keys.
    

**Reference**

-   [https://supabase.com/docs/guides/getting-started/migrating-to-new-api-keys](https://supabase.com/docs/guides/getting-started/migrating-to-new-api-keys)
    
-   [https://supabase.com/docs/guides/getting-started/api-keys](https://supabase.com/docs/guides/getting-started/api-keys)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.