Every project has two API keys and a JWT secret, shown on the project pages in the dashboard.
| Key | Where to use it |
|---|---|
| anon (public) | Browsers and mobile apps. Requests are limited by Row Level Security. |
| service_role (secret) | Trusted servers only. It bypasses Row Level Security and can manage users. |
| JWT secret | Verify user access tokens on your own servers. |
#Where to find them
The anon key is on the project overview; all keys are in Settings → API keys and in Studio under API → Keys. Secret values are hidden until you reveal them. Team members with the Read-only role never see the service_role key, the JWT secret or the database password (see Teams and roles).
#How they work
The anon and service_role keys are JWTs signed with your project's JWT secret, with the role anon or service_role. Send one in the apikey header of every request.
Keys and the JWT secret can't be rotated from the dashboard. If a secret leaks, contact the StitchDB team.