First things first, log into the Supabase dashboard with your account credentials. Once you're in, head over to the project where you want to secure those endpoints with API keys.

On the project overview page, look for the "API" section in the left-side menu and click on it. This is where you'll find all the settings related to API configuration, including the keys.

In the API section, you'll see categories like "Service Role Key" and "Anon Key". These are the API keys Supabase provides.

Go ahead and copy the relevant API keys. The "Service Role Key" is for admin tasks that need higher permissions, while the "Anon Key" is for regular, authenticated users.

Now, open your application's environment file (like .env) and add these API keys securely. For example:

SUPABASE_URL=your-supabase-instance-url
SUPABASE_ANON_KEY=your-anon-key
SUPABASE_SERVICE_ROLE_KEY=your-service-role-key

Just make sure to replace your-supabase-instance-url, your-anon-key, and your-service-role-key with your actual Supabase project details.

In your app code, set up the headers for API requests to include the API keys. Here’s how you can do it in a JavaScript fetch request:

const response = await fetch('your-endpoint-url', {
    method: 'GET', 
    headers: {
        'apikey': process.env.SUPABASE_ANON_KEY,
        'Authorization': `Bearer ${process.env.SUPABASE_ANON_KEY}`
    }
});

Replace 'your-endpoint-url' with your specific Supabase function or endpoint URL.

For extra security, you can configure Supabase policies to restrict direct access to your endpoints. In the Supabase dashboard, go to the "Auth" and "Policies" sections. Create or update policies to make sure only authorized requests are allowed.

Test your app to make sure API requests are working as expected and that endpoints are secured properly. Ensure unauthorized requests are blocked and the right permissions are enforced.

Make it a habit to rotate your API keys periodically to reduce security risks. Update your environment variables and app code with the new keys as part of your maintenance routine.

Keep your API keys safe and limit their exposure to only essential personnel and environments.