What is a service role key?
The service role key is a Supabase key that ignores every row level security rule, so whoever holds it can read, change and delete everything in your database. It is meant only for code that runs on your server. If it ends up in your front-end code, anyone can copy it and take full control of your data.
ON THIS PAGE
What it means
Supabase gives you two main keys. The anon key is designed to be public and is held back by your row level security rules. The service role key is the master key: it bypasses those rules completely.
Because it ignores the rules, it must stay on the server, in places like edge functions, where visitors can never read it.
Why it matters for vibe-coded apps
When a feature hits a row level security error, an AI tool may 'fix' it by swapping in the service role key, and the error disappears.
- Anyone can download every table, including private user data.
- Anyone can edit or delete your data, with no way to tell it was not you.
- Rotating the key later means updating everything that uses it.
Example
A front-end file that talks to Supabase.
const supabase = createClient(
"https://abc.supabase.co",
"eyJhbGciOi…service_role…"
);// Front end: the anon key, limited by row level security
const supabase = createClient(url, import.meta.env.VITE_SUPABASE_ANON_KEY);
// Edge function (server only)
const admin = createClient(url, Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!);If you need a privileged action from the front end, put it in an edge function and call that instead.
How to check if your app has this problem
- 1Search your code for service_role and SUPABASE_SERVICE_ROLE_KEY.
- 2Make sure it only appears in server code, never in files that are sent to the browser.
- 3Open your live site, view the page source and search for eyJ. Keys starting that way are tokens. Anything that decodes to the role service_role is a leak.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Reset the key in your Supabase dashboard under Project Settings, API. Do this first if it was ever public.
- 2Use only the anon key in the front end.
- 3Move any privileged work into an edge function that reads the new key from an environment variable.
- 4Make sure row level security is on for every table, then run a check again.
Find every use of the Supabase service role key in my project. Remove it from all front-end code and use the anon key there instead. Move anything that needs elevated access into a Supabase edge function that reads SUPABASE_SERVICE_ROLE_KEY from an environment variable, and make the front end call that function. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for service role key issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Row level securityA database setting that decides which rows each user can see or change.
- API key exposureA secret key for a paid service ends up where the public can see it.
- Environment variablesSettings stored outside your code, used to keep secrets out of it.
- Public storage bucketA folder of uploaded files that anyone with the link can open.
Related reading
Need help?
Not sure what this means for your app? Our team will explain it in plain English.