Is it safe to expose the Supabase anon key?

Updated

Is it safe to expose the Supabase anon key in my frontend?

Yes. The anon key (called the publishable key in newer projects) is designed to be public and ships in every Supabase front end. What protects your data is row level security (RLS): without RLS policies, anyone with that key can read and change your tables. The key you must never expose is the service role (secret) key.

Why the anon key is public by design

Supabase gives your website direct access to the database through an API. The browser has to identify which project it is talking to, so the anon key is included in your JavaScript bundle. Anyone can open the browser tools and copy it. That is expected.

The anon key only grants the permissions of the anon and authenticated roles. Row level security policies then decide, row by row, what those roles may read or change.

What actually goes wrong

In apps built with Lovable, Bolt and v0 we see the same three problems again and again:

  • A table with RLS switched off: anyone with the public key can read and modify every row.
  • A policy with USING (true) on UPDATE or DELETE: anyone can change anyone's data.
  • The service role key in front-end code or in a VITE_ / NEXT_PUBLIC_ variable: that key bypasses RLS completely.

How to check your project

Every table in the public schema should have RLS enabled and policies that compare a user id column to auth.uid(). Paste your migrations into our free policy checker to see who can read and change each table.

alter table public.notes enable row level security;
create policy "Users read own notes" on public.notes
  for select to authenticated using (auth.uid() = user_id);

Questions

Can someone steal my data with the anon key?

Only if your RLS policies allow it. With RLS enabled and owner-based policies, the anon key alone gives access to nothing private.

Which Supabase key must stay secret?

The service role key (secret key). It bypasses all RLS. Use it only in server code such as Edge Functions, read from an environment variable.

Should I rotate my anon key?

Not because it is public. Rotate the service role key if it was ever committed to git or shipped to the browser.