Adding custom API keys with selectable Postgres role for backend components

Problem When using a secret key for backend components, we grant them all privileges of the service_role so in most cases they have access to parts of the db they do not need to have or actually shouldn't. In my understanding this violates the principle of least privilege even if security is properly enforced in the backend components. Suggestion Adding the possibility in Project Settings -> API Keys to add a 'Service Key' (legacy service_role API key is not meant) where you can select a Postgres role. Custom roles can be selected there so we can use other roles then anon, authenticated and service_role (from the publishable/secret key) in a backend components. With the custom Postgres role we have fine control over what the backend components can access in the db. Current solution For people interested, this is my current approach in detail: 1. Generating new signing keys via supabase cli (be careful with exposing the key in shell history): 2.…