anon key

anon key — the public Supabase API key intended for browser and mobile clients, where anyone can read it.

The anon key is a signed JWT with the anon role baked into its claims. It is safe to ship in client-side code because it grants no privileges on its own. Every request made with it runs as the anon (or, after login, authenticated) Postgres role, so it can only touch rows your Row Level Security policies allow. A table with RLS enabled and no matching policy returns zero rows to an anon-key request, even though the key is valid.

Contrast this with the service role key, which carries the service_role claim and bypasses RLS entirely. The service role key must never appear in a client — treat it like a database password.

You can confirm which role a key carries by decoding its payload:

# The middle segment of the JWT is base64url-encoded JSON
echo "$ANON_KEY" | cut -d. -f2 | base64 -d 2>/dev/null
# → {"iss":"supabase","ref":"abcxyz","role":"anon","iat":...,"exp":...}

Both keys are shown in your Supabase dashboard under Project Settings → API. When you move a project to your own Supabase, the destination has its own anon and service role keys — the source keys do not carry over, so update your client's environment variables after migrating.