What is Public (publishable) key?

A key that is meant to be in your website. It is safe only when database rules decide what it can do.

Where Public (publishable) key goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

  • Into the app stores · 4 minutes · Free

    The key inside the app

    Your phone app went live on Friday. By Monday your OpenAI bill is $2,300, and the usage page shows requests your app never makes.

    Can people see API keys in my Expo app?

    Yes. Expo copies every EXPO_PUBLIC_ variable into the JavaScript inside your app, and anyone can download the app and read it. Public keys like the Supabase anon key are fine there. Secret keys for OpenAI, Stripe or other paid services must stay on a server function that your app calls instead.

    Walk it, free

  • Who may see what · 5 minutes · Pro

    The table anyone can read

    Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.

    Why can anyone read my Supabase table?

    Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().

    Read the fix

Related terms

API
The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
Server
A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Browser
Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Table, row, column
A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).
Supabase
A popular hosted database with sign-in and file storage built in. Many AI app builders use it behind the scenes.
Row Level Security (RLS)
Database rules that decide which rows each user may see or change. With it off, anyone with your public key can read everything.

All 62 terms in the glossary