Use Project URL and publishable key (or legacy anon public key). Never use service_role/secret key here.