fix(Docs): Remove legacy option for service key rotation (#44753)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Documentation**
* Simplified guidance for handling leaked or compromised service_role
(JWT) keys: consolidated prior branching instructions into a single,
clear recommendation to replace the service_role key via the standard
secret-key rotation process to avoid downtime.
* Removed an obsolete "rotate service role key" further-reading link to
streamline troubleshooting and reduce duplication.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: Cameron Blackwood <38852603+Reikon95@users.noreply.github.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This commit is contained in:
Jeremias Menichelli
2026-04-13 14:29:34 +02:00
committed by GitHub
parent f457417c8d
commit a5cd7fdb09
2 changed files with 3 additions and 7 deletions

View File

@@ -148,10 +148,9 @@ Rotating a secret key (`sb_secret_...`) is easy and painless. Use the [API Keys]
**Deleting a secret key is irreversible and once done it will be gone forever.**
If you are still using the JWT-based `service_role` key, there are two options.
If you are still using the JWT-based `service_role` key, replace the `service_role` key with a new secret key instead. Follow the guide from above as if you are rotating an existing secret key.
1. **Strongly recommended:** Replace the `service_role` key with a new secret key instead. Follow the guide from above as if you are rotating an existing secret key.
2. [Rotate your project's JWT secret.](/dashboard/project/_/settings/jwt) This operation is only recommended if you suspect that the JWT secret has leaked itself. Consider switching your `anon` JWT-based key to the publishable key, and all `service_role` JWT-based keys to secret keys. Only then rotate the JWT secret. Check the FAQ below if you use the JWT-based keys in mobile, desktop or CLI applications!
If you believe this is not possible for your implementation, [contact Support](/dashboard/support/new).
## Known limitations and compatibility differences
@@ -167,9 +166,7 @@ As the publishable and secret keys are no longer JWT-based, there are some known
### I am using JWT-based `anon` key in a mobile, desktop, or CLI application and need to rotate my `service_role` JWT secret?
If you know or suspect that the JWT secret itself is leaked, refer to the section on [rotating the JWT](#what-to-do-if-a-secret-key-or-servicerole-has-been-leaked-or-compromised).
If the JWT secret is secure, prefer substituting the `service_role` JWT-based key with a new secret key which you can create in the [API Keys](/dashboard/project/_/settings/api-keys) dashboard. This will prevent downtime for your application.
If the JWT secret is secure, substitute the `service_role` JWT-based key with a new secret key which you can create in the [API Keys](/dashboard/project/_/settings/api-keys) dashboard. This will prevent downtime for your application.
### Can I still use my old `anon` and `service-role` API keys after enabling the publishable and secret keys?

View File

@@ -46,6 +46,5 @@ If you have migrated to new symmetric JWT signing keys:
## Further readings
- [How to rotate the service role key](/docs/guides/api/api-keys#i-am-using-jwt-based-anon-key-in-a-mobile-desktop-or-cli-application-and-need-to-rotate-my-servicerole-jwt-secret)
- [What to do if a secret key or service_role has been leaked or compromised?](/docs/guides/api/api-keys#what-to-do-if-a-secret-key-or-servicerole-has-been-leaked-or-compromised)
- [JWT Signing Keys](/docs/guides/auth/signing-keys)