API keys

Two kinds

• Publishable (pgb_pub_...): safe in browsers and mobile apps; SQL runs under row-level security.
• Secret (pgb_sec_...): for servers only; full access.

Send them as x-api-key or Authorization: Bearer.

Create one

1. Open Project Settings > Project API Keys.
2. Choose + Generate Key.
3. Enter a Key Name / Label and pick Publishable or Secret Key.
4. Choose Generate Key, copy the token, then I Have Saved My Key. It is shown once.

The table afterwards shows prefix, creation date and Last Used.

Row-level security

Open RLS Policies. A table with RLS off is open to publishable traffic; with RLS on and no policies it is closed. Use templates such as "Users can only access their own rows".

Rotate

Create a new key, deploy it, then Revoke the old one.

Account keys

Account Security has account-level keys (pgb_live_..., up to 10) with scopes and permission presets, and Revoke all API keys.

Try it

Create a publishable key labeled "web", turn RLS on for one table and add a policy.

What next

Continue with PGBHub Console 301: Running in production.

Recap

• Publishable in clients, secret on servers only.
• Rotate by replacing, never by sharing.