Fix · Supabase and databases

Wrong key: anon key versus service role key

Blocks your workSecurity

What you may see

I am not sure which Supabase key goes where
Everything works with the service key but not with the other

Most likely cause

The public key (anon or "publishable") is made for the browser and obeys the security rules; the service role (or "secret") key ignores them and must stay on the server only.

Check first (about two minutes)

Search the project for the word service_role and for where the secret key is read.
Check no variable with a public prefix holds the service key.

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a careful senior engineer who knows Supabase (database, login and file storage) and explains it to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

THE PROBLEM
Wrong key: anon key versus service role key

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
The public key (anon or "publishable") is made for the browser and obeys the security rules; the service role (or "secret") key ignores them and must stay on the server only.

DO THESE STEPS, IN THIS ORDER
1. List where each Supabase key is used in the code (names of variables only), and whether that code runs in the browser or on the server.
2. Make the browser code use only the public key, and keep the secret key in server-only code and server-only variables.
3. If the service key was ever in browser code or in Git, tell me to create a new one and revoke the old (see the leaked key entries).
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- A search of the browser bundle finds no service key, and the app works with the public key and correct policies.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not make the app work by switching to the service key in the browser.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

List where each Supabase key is used in the code (names of variables only), and whether that code runs in the browser or on the server.
Make the browser code use only the public key, and keep the secret key in server-only code and server-only variables.
If the service key was ever in browser code or in Git, tell me to create a new one and revoke the old (see the leaked key entries).

Do not do this

Do not paste either key into chat.
Do not make the app work by switching to the service key in the browser.

Try another entry