From the source
Some changes may be breaking.
Postgres Row Level Security (RLS) is powerful but can be complex for developers new to the pattern.
Most of the changes in 2025 focused on safer defaults and better tooling to make security more accessible.
We'll cover what shipped in 2025 and outline planned improvements for 2026.
Disabling the Data API when creating a project # New projects can disable the Data API entirely or change the default schema from public to a custom schema like api .
This gives you control over what's exposed via the auto-generated REST and GraphQL APIs.
Disabling the Data API on existing projects # Existing projects can disable the Data API in project settings.
Once disabled, you can continue to use the database like standard Postgres (similar to RDS), connecting directly or through the connection pooler.
New API keys # The new API key model replaces long-lived JWT-based anon and service_role keys.
Projects now use publishable keys for low-privilege access and multiple revocable secret keys for elevated access.
…
