One-time setup. These are stored on this device only and never leave it — the app talks straight to your own Supabase.
Supabase → API Keys → Publishable key (starts sb_publishable_).
Older projects call it the anon key — that works too.
Never the secret key. It bypasses row-level security, and anything in a browser can be read by anyone.
connecting…