Database / Supabase basics Interview Questions
Why doesn't Supabase recommend using the service_role key on the client?
The service_role key is designed to connect to Postgres as a role that has RLS_bypass privileges built in — it doesn't just have broad permissions, it explicitly skips the Row Level Security checks that every other connection is subject to. That makes it functionally equivalent to a database superuser for the purposes of the API.
If that key ships inside a mobile app binary or a public web bundle, anyone who inspects the network traffic or decompiles the app can extract it and use it to read or write any row in any table, completely ignoring the ownership and access rules the rest of the app depends on. This is categorically different from leaking the anon key, which is meant to be public and is still constrained by RLS — a leaked anon key is a non-event by design, while a leaked service_role key is a full data breach.
In practice, the service_role key should only ever be used from environments a client can't inspect: Edge Functions, a backend server, or CI/CD scripts running migrations, and ideally stored as an encrypted secret rather than an environment variable checked into source control.
Invest now in Acorns!!! 🚀
Join Acorns and get your $5 bonus!
Acorns is a micro-investing app that automatically invests your "spare change" from daily purchases into diversified, expert-built portfolios of ETFs. It is designed for beginners, allowing you to start investing with as little as $5. The service automates saving and investing. Disclosure: I may receive a referral bonus.
Invest now!!! Get Free equity stock (US, UK only)!
Use Robinhood app to invest in stocks. It is safe and secure. Use the Referral link to claim your free stock when you sign up!.
The Robinhood app makes it easy to trade stocks, crypto and more.
Webull! Receive free stock by signing up using the link: Webull signup.
More Related questions...
