Leaked Supabase service_role or secret key: what to do

Rotation order (from Supabase docs)

1. Fix the root cause of the leak first (move the key server-side, remove it from the bundle).
2. Create a new secret key in Dashboard → Settings → API Keys.
3. Replace the compromised key everywhere your backend uses it.
4. Confirm every component uses the new key.
5. Retire the old key: delete a leaked secret key (irreversible), or deactivate legacy JWT keys (reversible).

Source: Supabase docs: API keys (section “Rotate a leaked or compromised key”).

Prevent it next time

• Never give a server-only env var a public prefix like NEXT_PUBLIC_ — your bundler will ship it.
• Use one secret key per backend component so a leak means one rotation.
• Never log full keys; Supabase suggests at most 6 characters of the random part, or a SHA-256 hash.

FAQ

Will Supabase block a secret key used in a browser?

Supabase documents that new sb_secret_ keys return HTTP 401 when the User-Agent looks like a browser, but the key still works from other tools, so you must still rotate it.