"supabase_flutter anonKey Deprecated: Use publishableKey"
supabase_flutter anonKey deprecated: migrate Supabase.initialize() to publishableKey, sb_publishable_ vs sb_secret_ explained, plus key rotation.
If you ran dart analyze on a recent supabase_flutter version, you may have met this warning: anonKey is deprecated — use publishableKey instead. It's not just a rename. Supabase replaced its legacy JWT API keys with a new key system ( sb_publishable_ / sb_secret_ ), and the supabase_flutter anonKey deprecated warning is your cue to migrate. Legacy keys are being phased out — the plan communicated by Supabase is end of 2026 — so this is a "do it this quarter" task, not a "someday" task. This guide covers the full migration: the one-line Flutter fix, what each new key type is for, where to find and rotate keys in the 2026 dashboard, and the mistakes that have already caused real outages. *Last updated: October 3, 2026* What you'll learn Legacy JWT keys vs the new sb_publishable_ / sb_secret_ key system Migrating Supabase.initialize() from anonKey to publishableKey Publishable key vs anon key: same privileges, new format sb_secret_ vs service_role : server-only keys that must never ship in your app Where to find and rotate keys in the Supabase dashboard Why mixing legacy and new key formats causes 401 outages Legacy Keys vs New Keys: What's Changing The old system gave every project two JWTs: the anon key (public, low privilege, RLS-enforced) and the service_role key (secret, bypasses RLS). They were JWTs — decodable, long-lived, and awkward to rotate independently. The new system splits keys by prefix and purpose: Key Prefix Where it goes Privileges Publishable key sb_publishable_… Your Flutter app (client-side) Same low privileges as the old anon key — RLS enforced Secret key sb_secret_… Your server / edge functions only Elevated, like the old service_role — bypasses RLS The publishable key is not a secret — it ships in your app bundle, same as the anon…