Rotating Anon, Service, and JWT Secrets

[tylerfontaine]

This is a copy of a troubleshooting article on Supabase's docs site. It may be missing some details from the original. View the original article.

Have you ever accidentally committed a service key to a public repo? Or maybe rotating keys is something you regularly do for security compliance.
Whatever the reason, here's how to rotate the keys for your Supabase project.

If you haven’t migrated to asymmetric JWT signing keys:

We recommend that you migrate to asymmetric JWT signing keys and publishable/secret API keys as it is no longer possible to rotate the legacy anon, service and JWT secrets.
You can view this Get Started guide for steps to migrate to asymmetric JWT signing keys.

If you have migrated to new symmetric JWT signing keys:

1. Go to Project Settings → JWT Keyss in the Supabase Dashboard
2. Navigate to the JWT Signing Keys tab.
3. Click on Rotate Keys. This will move the current key to “Previously used keys”
4. Select the three-dot icon (action icon) of your previously used key and click “Revoke”. If you do not “Revoke” the key, older keys will still be valid.

Further readings

• What to do if a secret key or service_role has been leaked or compromised?
• JWT Signing Keys

[rayyeoh]

I've generated a new JWT secret but it has been 4 hours since. How long is the next step suppose to take? Do I restart the project whilst still in this state or has something gone wrong? Thank you for your input.

[GregTillman-coder]

i've done exactly this but the regenerate button is gone and they are pushing new JWT keys on me?! i need to fix this quick and can't change everything else i just need new keys