Rotate service key?

[joelr45]

Hi there,

Loving Supabase, recently started building on top of it, and just had a question about the service key. Is it possible to rotate the key? Just wondering for DR purposes. Or what would you say is the best way to handle bypassing RLS?

Thanks!

[childersd]

I was also looking for this. Scrolling a bit down, the dashboard states:

Generating a new JWT secret will invalidate all of your API keys, including your service_role and anon keys. Your project will also be restarted during this process, which will terminate any existing connections.

Unsure whether it's possible cryptographically, but I agree with @joelr45 that rotating individual keys is not an odd request.

[GaryAustin1]

The service role has nothing in it before encryption to rotate. It is just a few claims. So to rotate you have to change all your your codes and restart the project to disconnect all clients.
{
"role": "service_role",
"iat": 1639784255,
"exp": 1955360255
}
Is all it contains... iat is issue time, exp expire time.

[AJamesPhillips]

Update: if you click on the JWT's Generate a new secret button on your https://supabase.com/dashboard/project/abc...xyz/settings/api page it shows the following pop up:

So the text:

Generating a new JWT secret will invalidate all of your API keys, including your service_role and anon keys

is no longer shown on the dashboard but, a bit confusingly, it is shown when you try to generate a new JWT token.

[AltamerInvictus]

Hi, if I change the jwt tokens, will it have effect on tables or data storage? Or will they be the same

[GaryAustin1]

It does not impact data in the database. It only impacts the use of existing JWT's to access the REST API.