Find both in Supabase → Settings → API. Both are safe here: the publishable/anon key is designed to sit in a browser — row-level security is what protects your data, not the key. Never paste the secret or service_role key into anything.
Ledger
Cash spends and anything email never sees belong here.