API keys

There are two kinds of keys.

Project keys

In Project Settings > Project API Keys:

• Publishable (pgb_pub_...): safe in web and mobile apps. SQL runs under row-level security, so a table with RLS off is open to publishable traffic and with RLS on and no policies is closed. To scope to a signed-in end user, also send their access token in the X-PGB-User-Token header; without it requests run as the anonymous role.
• Secret (pgb_sec_...): backend servers only. Full access, bypasses RLS. Never put it in a browser or app.

Send keys as x-api-key: pgb_pub_... or Authorization: Bearer pgb_sec_....

Create a key

1. Choose + Generate Key.
2. Enter a Key Name / Label and choose Publishable or Secret Key.
3. Choose Generate Key.
4. Copy it from the dialog, then choose I Have Saved My Key. The full token is shown once; the table keeps only a prefix, creation date and last use.

Keys created with the project, Default Secret Key and Default Publishable Key, are not displayed; generate your own to get a value.

Rotate and revoke

There is no rotate button. Generate a new key, deploy it, then Revoke the old one (watch Last Used). Removing a member revokes keys they issued. Keys cannot manage members or billing.

Account keys

Account Security > API Keys & AI Agent Access holds up to 10 keys (pgb_live_...) for SDKs and AI tools. Generate New API Key asks for a label, scope (Account-Wide or Project-Scoped) and an IAM policy: Full Admin Access, Developer, Read-Only, Queues Only or custom rules. Each row offers Usage, Copy MCP, Revoke, Reinstate and Delete; Revoke all API keys disables everything.

Good to know

• Store secret keys in environment variables, never in code.
• Give each app its own key so you can revoke one.
• See Protect your account.