What is Supabase?

A popular hosted database with sign-in and file storage built in. Many AI app builders use it behind the scenes.

Where Supabase goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Into the app stores · 3 minutes · Pro
The sign-in link opened the website
On a phone, people tap the sign-in link in their email. Instead of opening your app, Safari opens your website's home page, signed out.
Why does my magic link open the website?
Supabase only redirects to addresses in its Redirect URLs list. If your app's callback, such as yourapp://auth/callback, isn't listed, Supabase silently sends people to the Site URL, which is usually your website. Add the exact callback address to the list and make sure the scheme matches your app config.
Read the fix
Who may see what · 5 minutes · Pro
The table anyone can read
Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.
Why can anyone read my Supabase table?
Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().
Read the fix
Who may see what · 4 minutes · Pro
Permission denied for table
Your AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.
Why does Supabase say permission denied for table?
The message 'permission denied for table' (error 42501) means the role making the request has no grant to use that table at all, so Row Level Security never runs. Since 30 October 2026, new Supabase tables are not exposed to the API until you grant access. Grant only the access each role needs, such as select to authenticated, and keep RLS policies on.
Read the fix
Into the app stores · 4 minutes · Free
The key inside the app
Your phone app went live on Friday. By Monday your OpenAI bill is $2,300, and the usage page shows requests your app never makes.
Can people see API keys in my Expo app?
Yes. Expo copies every EXPO_PUBLIC_ variable into the JavaScript inside your app, and anyone can download the app and read it. Public keys like the Supabase anon key are fine there. Secret keys for OpenAI, Stripe or other paid services must stay on a server function that your app calls instead.
Walk it, free
Data you can lose · 4 minutes · Pro
Exactly 1,000 orders
Your admin dashboard says you have 1,000 orders. It has said exactly 1,000 for three weeks.
Why does my Supabase query return only 1000 rows?
Supabase's API returns at most 1,000 rows per request by default, and it does not raise an error when it stops. Ask the database to count instead of downloading rows, and when you need every row, paginate with a stable order such as created_at then id.
Read the fix
Accounts and privacy · 3 minutes · Pro
The quiet email change
Someone used a customer's unlocked laptop for two minutes, changed the account's email to their own, then reset the password. The customer is locked out of their own account.
Should changing email need confirmation?
Yes. The email receives reset links and login codes, so changing it is as sensitive as changing the password. Ask for the current password, confirm the new address with a link, and notify the old address with a way to undo. In Supabase Auth, keep 'Secure email change' on so both addresses must confirm.
Read the fix

Table, row, column: A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).
Request: A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.
Server: A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
Database: Where your app keeps its data, organised in tables, like a set of spreadsheets.
Browser: Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
Row Level Security (RLS): Database rules that decide which rows each user may see or change. With it off, anyone with your public key can read everything.

All 62 terms in the glossary

Where Supabase goes wrong in real apps

Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.

Into the app stores · 3 minutes · Pro

The sign-in link opened the website

On a phone, people tap the sign-in link in their email. Instead of opening your app, Safari opens your website's home page, signed out.

Why does my magic link open the website?

Supabase only redirects to addresses in its Redirect URLs list. If your app's callback, such as yourapp://auth/callback, isn't listed, Supabase silently sends people to the Site URL, which is usually your website. Add the exact callback address to the list and make sure the scheme matches your app config.

Read the fix

Who may see what · 5 minutes · Pro

The table anyone can read

Your app uses Supabase straight from the browser. A stranger posts a screenshot of your whole users table on X.

Why can anyone read my Supabase table?

Your Supabase publishable (anon) key ships to every browser on purpose. Row Level Security decides which rows that key may read or change. If RLS is off on a table, or a policy uses (true), anyone can query every row. Turn RLS on and write policies around auth.uid().

Read the fix

Who may see what · 4 minutes · Pro

Permission denied for table

Your AI created a new 'invoices' table. Every page that reads it now fails, for every user, even you. RLS looks fine.

Why does Supabase say permission denied for table?

The message 'permission denied for table' (error 42501) means the role making the request has no grant to use that table at all, so Row Level Security never runs. Since 30 October 2026, new Supabase tables are not exposed to the API until you grant access. Grant only the access each role needs, such as select to authenticated, and keep RLS policies on.

Read the fix

Into the app stores · 4 minutes · Free

The key inside the app

Your phone app went live on Friday. By Monday your OpenAI bill is $2,300, and the usage page shows requests your app never makes.

Can people see API keys in my Expo app?

Yes. Expo copies every EXPO_PUBLIC_ variable into the JavaScript inside your app, and anyone can download the app and read it. Public keys like the Supabase anon key are fine there. Secret keys for OpenAI, Stripe or other paid services must stay on a server function that your app calls instead.

Walk it, free

Data you can lose · 4 minutes · Pro

Exactly 1,000 orders

Your admin dashboard says you have 1,000 orders. It has said exactly 1,000 for three weeks.

Why does my Supabase query return only 1000 rows?

Supabase's API returns at most 1,000 rows per request by default, and it does not raise an error when it stops. Ask the database to count instead of downloading rows, and when you need every row, paginate with a stable order such as created_at then id.

Read the fix

Accounts and privacy · 3 minutes · Pro

The quiet email change

Someone used a customer's unlocked laptop for two minutes, changed the account's email to their own, then reset the password. The customer is locked out of their own account.

Should changing email need confirmation?

Yes. The email receives reset links and login codes, so changing it is as sensitive as changing the password. Ask for the current password, confirm the new address with a link, and notify the old address with a way to undo. In Supabase Auth, keep 'Secure email change' on so both addresses must confirm.

Read the fix

Related terms

Table, row, column

A table is like one spreadsheet (orders). Each row is one item (one order); each column is one detail (price, date).

Request

A message your browser (or any program) sends to a server asking for something: 'give me invoice 105' or 'save this profile'.

Server

A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.

Database

Where your app keeps its data, organised in tables, like a set of spreadsheets.

Browser

Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.

Row Level Security (RLS)

Database rules that decide which rows each user may see or change. With it off, anyone with your public key can read everything.