> ## Documentation Index
> Fetch the complete documentation index at: https://docs.adhdsimple.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# Service Keys Policy

> Edge function service key usage and security policy

## Policy

```mermaid theme={null}
graph TB
    A[Edge Function Request] --> B{Needs Service Key?}
    B -->|No| C[Use Anon Key + Auth]
    B -->|Yes| D{Valid Use Case?}
    D -->|No| E[Refactor Required]
    D -->|Yes| F[Service Key Allowed]
    
    F --> G[Webhook Processing]
    F --> H[User Creation]
    F --> I[Cross-User Operations]
    F --> J[Auth Management]
```

## Valid Use Cases

### Webhook Processing

* **Purpose**: Validate external webhooks
* **Functions**: `checkout-stripe-webhook`, `sendgrid-webhook`
* **Reason**: No user context available

### User Creation

* **Purpose**: Create initial user records
* **Functions**: `patient-signup`
* **Reason**: User has no permissions yet

### Cross-User Operations

* **Purpose**: Send notifications across users
* **Functions**: `prescription-notifications`
* **Reason**: Must access multiple user records

### Authentication Management

* **Purpose**: Manage auth operations
* **Functions**: `auth-operations`
* **Reason**: Password resets, invitations

### Payment Processing

* **Purpose**: Process payments from webhooks
* **Functions**: `checkout-submit-order`
* **Reason**: Complex multi-table operations

### Mobile Sync

* **Purpose**: Sync data for mobile app
* **Functions**: `mobile-application-patient-sync`
* **Reason**: Cross-table data access

## Security Requirements

### Service Key Functions

* Document why service key is required
* Minimize data access scope
* Add audit logging for sensitive operations

### Anon Key Functions

* Always validate JWT tokens
* Use RLS policies for data access
* Add comments about RLS requirements

## Implementation

### Refactoring Checklist

1. Check if function only accesses user's own data
2. Verify RLS policies support the access pattern
3. Replace service key with anon key + auth header
4. Test all operations still work
5. Deploy updated function

### Code Pattern

```typescript theme={null}
// Create client with user auth
const supabase = createClient(
  Deno.env.get('SUPABASE_URL'),
  Deno.env.get('SUPABASE_ANON_KEY'),
  {
    global: {
      headers: {
        Authorization: authHeader
      }
    }
  }
);

// Verify user
const { data: { user }, error } = await supabase.auth.getUser();
if (error || !user) {
  return new Response(JSON.stringify({
    error: 'Invalid authentication'
  }), {
    status: 401
  });
}
```

<Note>
  **RLS Required**: Functions using anon key require proper RLS policies on all accessed tables
</Note>