Critical: How can we use rest apis when the key is public? Or Supabase at all