You're right, it's the Supabase's anonymous API key they send with each anonymous request.