Technical reference

Supabase Cheatsheet

Postgres, Auth, Storage, Realtime, and Edge Functions

Must Know

typescript

Create a Client

Publishable keys can be used by clients when exposed data is protected by RLS.

import { createClient } from "@supabase/supabase-js";

export const supabase = createClient(
  import.meta.env.PUBLIC_SUPABASE_URL,
  import.meta.env.PUBLIC_SUPABASE_PUBLISHABLE_KEY,
);

typescript

Query Postgres

const { data, error } = await supabase
  .from("projects")
  .select("id, name, created_at")
  .order("created_at", { ascending: false })
  .limit(20);

Row Level Security

sql

Enable RLS

RLS should enforce ownership in the database, not only in the interface.

alter table public.projects enable row level security;

create policy "users read their projects"
on public.projects
for select
to authenticated
using ((select auth.uid()) = user_id);

Service Keys

Use publishable keys in clients and least-privilege secrets on servers.

// Never expose secret or service-role keys in browser/mobile code.
// They bypass Row Level Security and belong only in trusted server environments.

Auth, Storage & Realtime

typescript

Sign In

const { data, error } = await supabase.auth.signInWithPassword({
  email,
  password,
});

typescript

Private Realtime Channel

Production channels need authorization policies and lifecycle cleanup.

const channel = supabase.channel("room:42:messages", {
  config: { private: true },
});

await channel.subscribe();
// Remove the channel during cleanup.
await supabase.removeChannel(channel);

typescript

Upload a File

Protect storage objects with policies and validate file type and size.

const { data, error } = await supabase.storage
  .from("avatars")
  .upload(`${user.id}/avatar.png`, file, { upsert: true });

Production Notes

typescript

Edge Function

Keep edge operations short-lived and idempotent; move heavy jobs to workers.

Deno.serve(async (request) => {
  const payload = await request.json();
  return Response.json({ received: payload });
});

# Local development
supabase functions serve

Security Checklist

A working query is not proof that its access policy is correct.

enable + test RLS
use least-privilege grants
never expose service secrets
validate function authorization
test policies with multiple users
index columns used by policies
plan backups and restore tests