The example for checking additional API keys has a security flaw and bad code.
It checked current_role for anon to do security, but because it is a security definer function the role will never be anon.
Added to check for the role claim in the jwt.
Also the table used for keys is UUID and the type from the header is text for the key. Cast it to UUID.
Filipe Cabaço