feat: rename anon key → publishable key, service role key → secret key

[grdsdev]

Summary

Updates API key terminology across code, tests, docs, and infra. No breaking changes — the old anonKey parameter is deprecated with a migration message pointing to the new name.

Changes

supabase_flutter — Supabase.initialize()

anonKey is deprecated in favour of publishableKey. Both are accepted; publishableKey takes precedence if both are supplied.

// Before (still compiles, emits deprecation warning)
await Supabase.initialize(url: url, anonKey: key);

// After
await Supabase.initialize(url: url, publishableKey: key);

publishableKey is the right name for the Flutter package: apps run on the client and should always use the publishable (anon) key. The doc comment now explicitly warns against using the secret key here.

supabase — SupabaseClient

The positional supabaseKey parameter is kept as-is — the plain Dart package is used in both client and server contexts, so a generic name is appropriate. The doc comment is updated to clarify the distinction:

Pass the publishable (anon) key for client-side usage or the secret key for trusted server-side environments.

Doc comments — GoTrueAdminApi / GoTrueAdminOAuthApi

References to `service_role` key updated to `secret` key to match the new naming.

What was intentionally left unchanged

• JWT role claims ('role': 'service_role') — internal backend values, unrelated to key naming
• ANON_KEY in infra/storage_client/docker-compose.yml — the storage binary reads this env var by name; renaming it would silently break the service
• CHANGELOG entries — historical entries are not refactored

🤖 Generated with Claude Code

[Vinzent03]

The SupabaseClient in the supabase package calls the argument supabaseKey. It is positional so renaming it is no breaking change, but I think it can/should also be renamed to align it with the rest and update the documentation of it.

[grdsdev]

@Vinzent03 I decided to go with supabaseKey in all public facing APIs, since keys can be either publishable or secret, please review it again.