security//API key

An API key is a credential that identifies an app to a service. There are two kinds, and they live in different places.

An API key is a credential that identifies an app to a service. There are two kinds, and they live in different places.

A publishable key (public) lives in the frontend, and every visitor's browser gets it. It is the light lock: enough to know which app is calling, not enough to access data. In Supabase it is the URL plus the anon key, which tells the SDK where the building is and opens the front door; the real security is the token together with RLS.

A secret key (private) lives only on the backend and never reaches the browser. In Supabase the service role key bypasses RLS entirely: it is the master key. In Google Cloud, the Client Secret proves that the server is who it claims to be during the OAuth handshake.

Keys are stored in environment variables (.env.local in development, the hosting dashboard in production), never committed to git and never sent to the frontend.