The Problem: Supabase Keys Control Your Database
Supabase provides two common keys: anon and service_role. While anon keys are limited by RLS, the service role key has full database privileges.
If your service_role key touches the frontend, your entire database is at risk.
Environment variables do NOT secure frontend builds. Anyone can inspect your network requests and extract exposed keys.
What Happens If Your Supabase Key Leaks?
- Full database access
- Unauthorized inserts/updates/deletes
- Data exfiltration
- Unexpected usage spikes
- Compliance nightmares
The Solution: The Salting Layer
Instead of calling Supabase directly from your frontend, you call your secure bridge:https://api.salting.io/r/salting-io-bridge-uuid
Your real Supabase key stays encrypted inside Salting. We handle:
- Secret key vaulting
- AES-256 request encryption
- CORS enforcement
- IP & rate limiting
- Abuse protection
You get backend-level security without running a backend.
How It Works
- Add your Supabase key (service_role or anon) to your Salting dashboard.
- Generate a private Bridge URL.
- (Optional) Lock usage to your domain.
- Replace direct Supabase calls with your bridge URL.
- Deploy instantly.
No Edge Functions. No custom backend.
Salting vs Traditional Backend Setup
🚧 Traditional Backend Proxy
- Requires Node.js / Go server
- Manual CORS configuration
- Secret key stored in your infrastructure
- Custom rate limiting logic
- Ongoing maintenance
☁ Supabase Edge Functions
- Deployment configuration required
- Secrets management complexity
- Cold start potential
- Still backend infrastructure
⚡ Salting Layer (Recommended)
- No server required
- Encrypted key vault
- Built-in CORS enforcement
- Integrated rate limiting
- Abuse protection by default
- Deploy in under 2 minutes
What Can You Build?
- Secure admin dashboards
- AI + Supabase apps
- Internal tools
- SaaS products
- Protected write endpoints
Perfect for React, Next.js, Angular, Vue, and static deployments.
Frequently Asked Questions
Should I expose the service_role key in frontend?
Never.
Is the anon key safe?
Only if RLS is properly configured — but extra protection is recommended.
Does this replace Edge Functions?
If you only use them to protect keys, yes.
Does Salting add latency?
Minimal edge overhead (typically sub-30ms).
Stop Exposing Your Database Keys
If your frontend can access your Supabase service role key, attackers can too. Secure it in minutes.