Skip to content
Cratebase

API keys

Superusers can mint API keys from the dashboard’s API keys page. A key comes in one of two shapes, chosen when it’s minted:

  • Superuser (the default) — unscoped root. It bypasses every collection rule, the same trust tier as Supabase’s own service_role key: powerful, unrestricted, and something to guard as carefully as a database password. Never hand one to a client you don’t fully trust with everything in the database.
  • Record-scoped — the key acts as a real record in a real auth collection (users, _superusers, or a custom auth collection). It gets the exact same rule-gated access that record has and nothing more — the same access it would have logging in normally, no second permission system involved.

A record-scoped key is the credential to reach for a CI job, a service, or an MCP-connected agent: it can only do what the record it acts as could do, so a compromised key leaks exactly as much as a compromised login for that one record — not the whole database. See Reference → REST API → API keys for the exact request shape.