Click any AI circle above with a to read their individual answer!
The Supabase service‑role key is located in the Settings → API page of your project’s dashboard and should only be used in trusted server‑side code.
- Find it under Project Settings → API → Service Role.
- It is a secret JWT that bypasses all Row‑Level Security policies.
- Never expose the key in client‑side code or public repositories.
- For local development, the key is stored in the `.supabase/kong/kong.yml` file.
- All models agree the key is located under Settings → API in the Supabase dashboard.
- All models stress that the service‑role key is a secret and must not be used in client‑side code.
- Only the first model mentions the local CLI file
.supabase/kong/kong.ymlas a place to find the key; the others do not cover local development.
How to locate your Supabase Service‑Role key
1. In the Supabase Dashboard (Hosted projects)
- Go to the Supabase Dashboard at https://app.supabase.com and sign in.
- Select the project you need the key for.
- In the left‑hand navigation, click Settings (gear icon) → API.
- Scroll to the Project API keys section.
- The key labeled
service_role(sometimes shown assecret_key) is your service‑role key. Use the Copy button to copy it to your clipboard.
⚠️ Security warning: The service‑role key can bypass any Row‑Level Security (RLS) rules. It must only be used in server‑side environments (e.g., backend services, cloud functions) and never be shipped to browsers or stored in public repos. [1]
2. In a local Supabase development environment (Supabase CLI)
If you are running Supabase locally:
Open the root folder of your Supabase project.
Open the file
.supabase/kong/kong.yml.Near the bottom, under the
consumerssection, you will see a line similar to:service_role: <your‑service‑role‑key>This is the same secret used by the hosted dashboard.
3. Best practices for handling the key
- Store securely: Use environment variables (e.g.,
SUPABASE_SERVICE_ROLE_KEY) in your deployment platform. - Rotate when needed: Changing the service‑role key will generate new JWT secrets for both anon and service keys. [2]
- Limit exposure: Do not commit the key to source control; add it to
.gitignoreif stored in local files.
Quick recap
| Where | How to find | Usage |
|---|---|---|
| Dashboard | Settings → API → Service Role | Server‑side code, cloud functions |
| Local CLI | .supabase/kong/kong.yml |
Local development, testing |
For further details, see the official Supabase docs on API keys [1] and community discussions on key management [2][4].