What is Grant?

Permission for a type of user to use a table at all. Without it you get 'permission denied', before any row rules are checked.

Where Grant goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Who may see what · 4 minutes · Pro
Permission denied for table
Your AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.
Why does Supabase say permission denied for table?
The message 'permission denied for table' (error 42501) means the role making the request has no grant to use that table at all, so Row Level Security never runs. Since 30 October 2026, new Supabase tables are not exposed to the API until you grant access. Grant only the access each role needs, such as select to authenticated, and keep RLS policies on.
Read the fix
Who may see what · 4 minutes · Pro
One field, a million credits
A free user now has 1,000,000 AI credits and the Pro plan. Stripe shows they never paid.
How do users give themselves a paid plan?
If users may update their own row and that row also stores plan, credits or role, they can send those fields in a normal request. Keep anything that grants access or money in a table users can only read, change it from the server, and grant paid plans only from a verified payment event.
Read the fix
Who may see what · 5 minutes · Pro
The table anyone can read
Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.
Why can anyone read my Supabase table?
Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().
Read the fix
Bills that explode · 4 minutes · Pro
500 signups overnight
You give every new account 50 free AI credits. You wake up to 500 new signups and no new customers.
How do I stop fake accounts abusing my free tier?
Make farming expensive and real signups easy: verify email before granting free credits, normalise addresses such as Gmail dot variants, rate-limit signups per IP address, and add a bot check. No single step stops a determined abuser; several small ones together make it not worth the effort.
Read the fix
Getting paid · 4 minutes · Free
The success page anyone could visit
Your app has 41 Pro accounts. Stripe shows 29 paying customers. Nobody hacked anything: twelve people just typed an address.
Should I grant access on the Stripe success page?
No. The success page is just where the browser lands after checkout, and anyone can type its address, so granting access there gives your paid plan away. Grant access in your webhook when Stripe sends checkout.session.completed, verified by its signature. Let the success page only read and display the plan your database already holds.
Walk it, free
Don't trust the browser · 4 minutes · Free
The $1 Pro plan
Your Pro plan costs $49 a year. Stripe shows three new Pro customers this morning who each paid $1.
Can users change the price at checkout?
Yes, if your server takes the amount or price ID from the browser. Anything the browser sends can be edited, so a visitor can create a checkout at any price. Send only which plan the visitor wants, and have the server look up the allowed price from its own list before creating the Stripe checkout.
Walk it, free

Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Webhook: A message another service (like Stripe) sends to your server to say something happened, such as 'this customer paid'.
Stripe: A popular payments service. It charges cards and tells your app what happened through webhooks.
API: The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.

All 62 terms in the glossary

Where Grant goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Who may see what · 4 minutes · Pro

Permission denied for table

Your AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.

Why does Supabase say permission denied for table?

The message 'permission denied for table' (error 42501) means the role making the request has no grant to use that table at all, so Row Level Security never runs. Since 30 October 2026, new Supabase tables are not exposed to the API until you grant access. Grant only the access each role needs, such as select to authenticated, and keep RLS policies on.

Read the fix

Who may see what · 4 minutes · Pro

One field, a million credits

A free user now has 1,000,000 AI credits and the Pro plan. Stripe shows they never paid.

How do users give themselves a paid plan?

If users may update their own row and that row also stores plan, credits or role, they can send those fields in a normal request. Keep anything that grants access or money in a table users can only read, change it from the server, and grant paid plans only from a verified payment event.

Read the fix

Who may see what · 5 minutes · Pro

The table anyone can read

Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.

Why can anyone read my Supabase table?

Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().

Read the fix

Bills that explode · 4 minutes · Pro

500 signups overnight

You give every new account 50 free AI credits. You wake up to 500 new signups and no new customers.

How do I stop fake accounts abusing my free tier?

Make farming expensive and real signups easy: verify email before granting free credits, normalise addresses such as Gmail dot variants, rate-limit signups per IP address, and add a bot check. No single step stops a determined abuser; several small ones together make it not worth the effort.

Read the fix

Getting paid · 4 minutes · Free

The success page anyone could visit

Your app has 41 Pro accounts. Stripe shows 29 paying customers. Nobody hacked anything: twelve people just typed an address.

Should I grant access on the Stripe success page?

No. The success page is just where the browser lands after checkout, and anyone can type its address, so granting access there gives your paid plan away. Grant access in your webhook when Stripe sends checkout.session.completed, verified by its signature. Let the success page only read and display the plan your database already holds.

Walk it, free

Don't trust the browser · 4 minutes · Free

The $1 Pro plan

Your Pro plan costs $49 a year. Stripe shows three new Pro customers this morning who each paid $1.

Can users change the price at checkout?

Yes, if your server takes the amount or price ID from the browser. Anything the browser sends can be edited, so a visitor can create a checkout at any price. Send only which plan the visitor wants, and have the server look up the allowed price from its own list before creating the Stripe checkout.

Walk it, free

Related terms

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Webhook

A message another service (like Stripe) sends to your server to say something happened, such as 'this customer paid'.

Stripe

A popular payments service. It charges cards and tells your app what happened through webhooks.

API

The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.