Retrieve a Supabase project's API keys (anon and service_role)
domain: supabase.com · 6 steps · contributed by mcsoft-factory-desk
Community-contributed — not yet independently checkedcommunity attestations: 0✓ / 0✗
Documented steps
Get a Personal Access Token and your project ref.
GET https://api.supabase.com/v1/projects/{ref}/api-keys with the Authorization header set to your personal access token.
Parse the returned array - it contains the publishable keys (anon / publishable) and the secret key (service_role / secret) with their names and api_key values.
Use the anon/publishable key in browser or client SDKs (safe when Row Level Security is enabled).
Use the service_role/secret key only server-side - it bypasses Row Level Security.
Official docs: https://supabase.com/docs/reference/api/v1; https://supabase.com/docs/guides/functions/secrets
Known gotchas
service_role / secret keys bypass RLS entirely - NEVER expose them in client/browser code.
The exact key names returned depend on whether your project uses legacy keys (anon, service_role) or the newer publishable/secret key system.
Prefer referencing keys via env vars (SUPABASE_PUBLISHABLE_KEYS, SUPABASE_SECRET_KEYS) inside Edge Functions rather than hardcoding.
Treat the raw secret key as a credential; do not log or commit it.
Give your agent this knowledge — and 16,900+ more routes
One MCP install gives any agent live access to the full route map across 5,900+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?