Service key for API authentication
Each tenant has their own service_keys table in their database
| Property |
Type |
Description |
allowed_namespaces? |
string[] |
Allowed table namespaces |
created_at |
string |
Creation timestamp |
created_by? |
string |
User who created the key |
deprecated_at? |
string |
Deprecation timestamp (for key rotation) |
description? |
string |
Description |
enabled |
boolean |
Whether the key is enabled |
expires_at? |
string |
Expiration timestamp |
grace_period_ends_at? |
string |
Grace period end for deprecated keys |
id |
string |
Unique identifier |
key_prefix |
string |
Key prefix (first 16 chars, for identification) |
key_type |
"anon" | "service" | "publishable" | "tenant_service" | "global_service" |
Key type. - anon — anonymous access - publishable — publishable client key (browser-safe) - service — elevated privileges, bypasses RLS (legacy admin-API type) - tenant_service — elevated, tenant-scoped (RLS-enforced) - global_service — elevated, cross-tenant, bypasses RLS |
last_used_at? |
string |
Last usage timestamp |
name |
string |
Display name |
rate_limit_per_hour? |
number |
Rate limit per hour |
rate_limit_per_minute? |
number |
Rate limit per minute |
replaced_by? |
string |
ID of replacement key (after rotation) |
revoked_at? |
string |
Revocation timestamp |
scopes |
string[] |
Permission scopes |
