Skip to content

docs: clarify that bare secret/publishable auth matches only the 'default' key #109

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tomaspozo merged 2 commits into from
Jul 27, 2026
Merged

docs: clarify that bare secret/publishable auth matches only the 'default' key #109

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
454c98a
docs: clarify that bare secret/publishable auth matches only the 'def…
claude Jul 27, 2026
2115731
docs: name the key match in the README API-key-protected example
claude Jul 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -89,7 +89,7 @@ export default {

```ts
// The mobile app browses the game catalog before the user signs in.
// auth: 'publishable' validates the apikey header against a publishable key —
// auth: 'publishable' validates the apikey header against the 'default' publishable key —
// gating the endpoint to your own clients while staying anonymous to the DB.
export default {
fetch: withSupabase({ auth: 'publishable' }, async (_req, ctx) => {
Expand Down Expand Up @@ -119,7 +119,8 @@ await fetch(catalogEndpoint, { headers: { apikey: publishableKey } })

```ts
// An admin dashboard fetches the list of featured games to curate.
// Secret key auth (not a user JWT) — supabaseAdmin bypasses RLS.
// auth: 'secret' validates the apikey header against the 'default' secret key
// (not a user JWT) — supabaseAdmin bypasses RLS.
export default {
fetch: withSupabase({ auth: 'secret' }, async (_req, ctx) => {
const { data: featuredGames } = await ctx.supabaseAdmin
Expand Down
4 changes: 2 additions & 2 deletions docs/auth-modes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,7 +81,7 @@ The caller must send:
apikey: sb_publishable_abc123...
```

By default, `publishable` mode validates against the `"default"` key in `SUPABASE_PUBLISHABLE_KEYS`. Use named key syntax to target a specific key or `publishable:*` to accept any key (see below).
> **Bare `publishable` matches only the `default` key.** `auth: 'publishable'` validates **only** against the key named `default` in `SUPABASE_PUBLISHABLE_KEYS`. It does **not** fall back to your named keys, so if every key in the set is named, bare `publishable` never matches. Use `publishable:<name>` to target a named key, or `publishable:*` to accept any key in the set — see [Named key syntax](#named-key-syntax).

## Secret mode

Expand All @@ -105,7 +105,7 @@ The caller must send:
apikey: sb_secret_xyz789...
```

By default, `secret` mode validates against the `"default"` key in `SUPABASE_SECRET_KEYS`. Use named key syntax to target a specific key or `secret:*` to accept any key (see below).
> **Bare `secret` matches only the `default` key.** `auth: 'secret'` validates **only** against the key named `default` in `SUPABASE_SECRET_KEYS`. It does **not** fall back to your named keys, so if every key in the set is named, bare `secret` never matches. Use `secret:<name>` to target a named key, or `secret:*` to accept any key in the set — see [Named key syntax](#named-key-syntax).

## None mode

Expand Down
Loading