https://shipreadyai.dev/glossary/service-role-key

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Service role key

The key that ignores every access rule. It belongs on a server and nowhere else.

A service role key is the backend key that bypasses row rules entirely. It exists so your server can do administrative work. Anyone holding it can read and write every row in every table, no matter what your policies say.

It belongs in a server secret, read inside server code at the moment it is used. It must never appear in a page, a bundle, a repository, a screenshot or a chat log. Once it is public it is not a leak you can reason about, it is a key change.

A check from outside reads your shipped JavaScript and looks for the shape of these keys. That is finding O4. A scan of 5,600 vibe-coded apps found more than 400 exposed secrets, so this is not a rare accident. If one is found, rotate it first and then ask how it got there.