mirror of
https://github.com/supabase/supabase.git
synced 2026-10-05 17:35:10 +03:00
Miranda Limonczenko
d7f1a44e53
## I have read the [CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md) file. YES ## What kind of change does this PR introduce? Docs update. Restructure, mostly moved lines, plus a tense fix in a shared partial. ## What is the current behavior? Context, procedure, and reference material are interleaved, so background reading interrupts the action path. - The page never states which key to use as an answer. You infer it from a five-column reference table. - Finding a key is a fragment inside an admonition, placed above the page's own definition of an API key. - Rotating a leaked key, the only procedure on the page, is the last H3. - The "Changes to API keys" notice narrates a past change in future tense, and "They will be deprecated" has no antecedent in its paragraph. ## What is the new behavior? Group the guide into context, procedure, and reference sections, per CONTRIBUTING § Guides on mixed information types. - Lead with "Which key do you use?", a decision table keyed on where the code runs. Section navigation sits directly below the intro. - Collect the conceptual sections under "How API keys work" and give publishable and secret keys parallel headings. - Promote both procedures into "Find and use your keys". Rotation is now an ordered procedure. - Move the enumerated secret key rules into "Security reference", grouped under bold labels by the kind of mistake each prevents, and leave a short danger admonition where secret keys are introduced. - Promote the five-sentence coexistence admonition to its own section. Admonitions are for short warnings. - Rewrite the shared deprecation partial for timeless documentation: present tense, no dangling "They", no "now". The partial renders on five pages. - Pin a stable anchor on the rotation heading and update the one inbound link, in the rotating-anon-service-and-jwt-secrets troubleshooting entry. - Align link text across docs for this guide. Twenty-one links pointed at it under fourteen labels, including two that named the wrong destination. Rule: when a link means the guide, the text is "API keys"; when it means a specific key or section, the specific text stays. Twelve now share "API keys", up from three. Review with `git diff --color-moved=zebra`. ## Additional context PR 2 of 4. Base is #49795. Includes the link-text alignment previously opened as #49866. ## Manual testing 1. Open the API keys guide on the deploy preview. 2. Check the table of contents. It shows three groups: How API keys work, Find and use your keys, Security reference. 3. Open the rotating-anon-service-and-jwt-secrets troubleshooting entry and follow "Rotate a leaked or compromised key" under Further readings. It lands on the renamed heading. 4. Open the Realtime Broadcast guide and check the "Changes to API keys" notice. It reads in present tense there too. <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit - **Documentation** - Updated API key guidance to explain the transition from legacy `anon` and `service_role` keys to publishable and secret keys by the end of 2026. - Reorganized the API keys guide with clearer key-selection guidance, security recommendations, usage examples, and rotation steps. - Updated troubleshooting references to point to the revised leaked-key rotation guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
51 lines
2.0 KiB
Plaintext
51 lines
2.0 KiB
Plaintext
<Accordion
|
|
type="default"
|
|
chevronAlign="right"
|
|
justified
|
|
size="medium"
|
|
className="rounded-lg border border-foreground/10 bg-surface-100 text-foreground-light [&>div]:space-y-4 p-4"
|
|
>
|
|
|
|
<AccordionItem
|
|
header="What you can do with the Metrics API"
|
|
id="how-do-i-check-when-a-user-went-through-mfa"
|
|
className="border-0 px-2 py-4"
|
|
>
|
|
|
|
Every Supabase project exposes a metrics feed at `https://<project-ref>.supabase.co/customer/v1/privileged/metrics`. Replace `<project-ref>` with the identifier from your project URL or from the dashboard sidebar.
|
|
|
|
1. Copy your project reference and confirm the base URL using the helper below.
|
|
|
|
<ProjectConfigVariables variable="url" />
|
|
|
|
2. Configure your collector to scrape once per minute. The endpoint already emits the full set of metrics on each request.
|
|
3. Authenticate with HTTP Basic Auth:
|
|
|
|
- **Username**: `service_role`
|
|
- **Password**: a **Secret API key** (`sb_secret_...`). You can create/copy it in [**Project Settings → API Keys**](/dashboard/project/_/settings/api-keys). For more context, see [API keys](/docs/guides/getting-started/api-keys).
|
|
|
|
To test locally, run `curl` with your Secret API key:
|
|
|
|
```bash
|
|
curl <project-url>/customer/v1/privileged/metrics \
|
|
--user 'service_role:sb_secret_...'
|
|
```
|
|
|
|
You can provision long-lived automation tokens in two ways:
|
|
|
|
- Create an account access token once at [**Account Settings > Access Tokens**](/dashboard/account/tokens) and reuse it wherever you configure observability tooling.
|
|
- **Optional**: programmatically exchange an access token for project API keys via the [Management API](/docs/reference/api/management-projects-api-keys-retrieve).
|
|
|
|
```bash
|
|
# (Optional) Exchange an account access token for project API keys
|
|
export SUPABASE_ACCESS_TOKEN="your-access-token"
|
|
export PROJECT_REF="your-project-ref"
|
|
|
|
curl -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
|
|
"https://api.supabase.com/v1/projects/$PROJECT_REF/api-keys?reveal=true"
|
|
```
|
|
|
|
</AccordionItem>
|
|
|
|
</Accordion>
|