I found little to no information about this and I don’t know where to ask. How do I initiate a BaaS (Backend as a Service) client? For example, I’ve been using Supabase, and I’ve already implemented about 80% of my website using the BaaS client on my app’s front end. This has turned out to be a challenge because now I have to migrate all the functions to the backend, which is built with Express.js.
I’m unsure where to start and need some clarification. I’ve built an Express.js app before, but I didn’t focus on security and there weren’t any API keys to deal with.
Any guidance or insights would be greatly appreciated.
So far, I’ve tried creating the BaaS client on the backend and sending it to the frontend, but I saw the key in the JSON response while checking it through Postman. Another approach I considered is creating admin endpoints with the admin secret key on the backend and using an anonymous (public) key on the frontend. However, if someone obtains that key, they could still manipulate the database.
Supabase has two type of keys Anon Key and Service Role Key.
The first one is used for frontend (client) usage while the Service Role Key is only for the backend and it should never be exposed to the client (it bypasses RLS and gives full access to the db).
You did not show any of your code so that maybe only a partial answer to you’re question. But I think it corrects some misunderstandings about the architecture of supabase. And if you are talking about the Anon Key which is visible on the frontend/client side, that is the purpose of that key 😉
rizzling is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.