supabase

Supabase Development Skill — Backend-as-a-Service Mastery

This skill provides comprehensive Supabase development patterns for building secure, scalable applications with PostgreSQL at the core, Row Level Security as the primary access control, and auto-generated APIs.

Key Principles

• Security at the Database Layer: Row Level Security (RLS) on ALL public tables
• PostgreSQL-First: Use PostgreSQL features (functions, triggers, policies) over application code
• Auto-Generated APIs: PostgREST provides instant CRUD without writing endpoints
• JWT-Based Auth: Every request carries auth context; RLS policies use auth.uid()

Client Setup

TypeScript Client

import { createClient } from '@supabase/supabase-js';
import type { Database } from './database.types'; // Auto-generated types

const supabase = createClient<Database>(
  process.env.SUPABASE_URL!,
  process.env.SUPABASE_ANON_KEY!,
  {
    global: {
      headers: {
        // Pass auth token for server-side requests
        Authorization: `Bearer ${userToken}`,
      },
    },
    auth: {
      autoRefreshToken: true,
      persistSession: true,
    },
  }
);

Type-Safe Client Generation

# Generate types from your database schema
npx supabase gen types typescript --linked > src/database.types.ts

Environment Keys

Key	Visibility	Use Case
SUPABASE_URL	Public	Client initialization
SUPABASE_ANON_KEY	Public	Client requests (anon role)
SUPABASE_SERVICE_ROLE_KEY	Server only	Bypasses RLS (admin operations)

WARNING: NEVER expose SERVICE_ROLE_KEY in client-side code.

Row Level Security (RLS)

Enable RLS on Every Public Table

-- MANDATORY: Enable RLS on every table exposed via the API
ALTER TABLE public.profiles ENABLE ROW LEVEL SECURITY;
ALTER TABLE public.projects ENABLE ROW LEVEL SECURITY;
ALTER TABLE public.tasks ENABLE ROW LEVEL SECURITY;

-- NEVER leave a table without RLS if it has data users shouldn't see