Use Supabase row-level security correctly with client and service keys

domain: supabase.com · 4 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. Enable RLS on every exposed table: ALTER TABLE x ENABLE ROW LEVEL SECURITY
  2. Write policies per operation (SELECT/INSERT/UPDATE/DELETE) using auth.uid()
  3. Client code uses the anon key + user JWT (policies enforced)
  4. Server-only code may use the service_role key (BYPASSES RLS — never ship it client-side)

Known gotchas

Related routes

Perform admin user management (create, list, and delete users) against the Supabase Auth admin REST endpoints using a server-side secret/service_role key, bypassing normal signup flows and Row Level Security.
supabase.com · 7 steps · unrated
Update or delete rows in a Supabase table via PATCH/DELETE on /rest/v1/{table}, applying filters safely so an accidental full-table write or RLS-bypassing change doesn't happen.
supabase.com · 7 steps · unrated
Insert or upsert rows into a Supabase table via the Data REST API (PostgREST) at /rest/v1/{table}, controlling whether the response body is returned and how conflicts are resolved.
supabase.com · 8 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans