mirror of
https://github.com/supabase/supabase.git
synced 2026-10-12 12:55:06 +03:00
6b8772a33e
Updates our documentation pages around the Data API to include instructions on how to grant the necessary privileges across API roles across tables and functions. Current behaviour means this is largely unnecessary as privileges are granted by default on public schema, but adding instructions will help cover scenarios where this isn't the case and expose some of the underlying magic happening. ## To test: - These updates refer to new settings that are added to the data api that give more visibility and control over what tables and functions are accessible via the api. - To view these settings you'll need enable `tableEditorApiAccessToggle ` feature flag <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added a new "Data API" guide and removed the old "Hardening the Data API" page * Updated navigation links to surface the new Data API guide * Expanded quickstarts, SDK install pages, and security guides with step‑by‑step Data API exposure, default‑privileges, RLS guidance, and SQL GRANT examples (including function EXECUTE notes) * Updated troubleshooting references and added redirects for legacy documentation paths <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: Claude Haiku 4.5 <noreply@anthropic.com> Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com> Co-authored-by: SaxonF <1072756+SaxonF@users.noreply.github.com> Co-authored-by: Chris Chinchilla <chris.ward@supabase.io> Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
34 lines
2.0 KiB
Plaintext
34 lines
2.0 KiB
Plaintext
---
|
|
id: 'securing-your-data'
|
|
title: 'Securing your data'
|
|
---
|
|
|
|
Supabase helps you control access to your data. With access policies, you can protect sensitive data and make sure users only access what they're allowed to see.
|
|
|
|
## Connecting your app securely
|
|
|
|
Supabase allows you to access your database using the auto-generated [Data APIs](/docs/guides/database/connecting-to-postgres#data-apis). This speeds up the process of building web apps, since you don't need to write your own backend services to pass database queries and results back and forth.
|
|
|
|
You can keep your data secure while accessing the Data APIs from the frontend, so long as you:
|
|
|
|
- Turn on [Row Level Security](/docs/guides/database/postgres/row-level-security) (RLS) for your tables
|
|
- Use your Supabase **anon key** when you create a Supabase client
|
|
|
|
Your anon key is safe to expose with RLS enabled, because row access permission is checked against your access policies and the user's [JSON Web Token (JWT)](/docs/learn/auth-deep-dive/auth-deep-dive-jwts). The JWT is automatically sent by the Supabase client libraries if the user is logged in using Supabase Auth.
|
|
|
|
<Admonition type="danger" label="Never expose your service role key on the frontend">
|
|
|
|
Unlike your anon key, your **service role key** is **never** safe to expose because it bypasses RLS. Only use your service role key on the backend. Treat it as a secret (for example, import it as a sensitive environment variable instead of hardcoding it).
|
|
|
|
</Admonition>
|
|
|
|
## More information
|
|
|
|
Supabase and Postgres provide you with multiple ways to manage security, including but not limited to Row Level Security. See the Access and Security pages for more information:
|
|
|
|
- [Row Level Security](/docs/guides/database/postgres/row-level-security)
|
|
- [Column Level Security](/docs/guides/database/postgres/column-level-security)
|
|
- [Data API](/docs/guides/database/data-api)
|
|
- [Managing Postgres roles](/docs/guides/database/postgres/roles)
|
|
- [Managing secrets with Vault](/docs/guides/database/vault)
|