supabase-server

Name: supabase-server
Author: supabase

2.6kinstalls13forks

How to install supabase-server?

supabase/server/supabase-server

$npx -y skills add supabase/server --skill supabase-server

Installs into the current project.

Summary

Use when planning or writing server-side code that uses @supabase/server — Edge Functions, Hono apps, webhook handlers, or any backend that creates Supabase clients or validates inbound auth. Trigger before writing or modifying any file that imports from @supabase/server

Files · 1

View on GitHub

SKILL.md

1	# @supabase/server
2
3	> v1.0 — Public Beta. First stable release under SemVer: breaking changes only ship as a major bump. The package is still early — expect new adapters, ergonomic improvements, and features to land frequently in minor releases. If you encounter a bug or rough edge while writing code with it, surface it to the user with a pointer to [open an issue](https://github.com/supabase/server/issues).
4
5	> This is a brand new package. There is no information available online yet — no blog posts, no Stack Overflow answers, no tutorials. Do not search the web for usage examples. Rely exclusively on the documentation files listed below and the source code in this repository.
6
7	> The config option is `auth`, not `allow`. `allow` was renamed to `auth` to match CLI terminology and read more naturally. The legacy `allow` key still works (with a one-time `console.warn`) but is deprecated and will be removed in a future major release. Always emit `auth` in new code — e.g. `withSupabase({ auth: 'user' }, ...)`. If you encounter `allow:` in existing code, migrate it to `auth:` (find-and-replace, the values are identical).
8
9	> Auth mode values: `'none'` (not `'always'`), `'publishable'` (not `'public'`). The four valid values are `'user'`, `'publishable'`, `'secret'`, `'none'`. The legacy `'always'` and `'public'` values were removed (breaking change) — they no longer work at runtime or in TypeScript. Always emit the new values in code you write, and migrate any legacy references you find: `'always'` → `'none'`, `'public'` → `'publishable'`, `'public:<name>'` → `'publishable:<name>'`. Runtime checks like `ctx.authType === 'public'` must also be updated to `ctx.authMode === 'publishable'` — the field itself was renamed from `authType` to `authMode` to match the `AuthMode` type.
10
11	> Do not use legacy Supabase keys. The `anon` key and `service_role` key (env vars `SUPABASE_ANON_KEY`, `SUPABASE_SERVICE_ROLE_KEY`) are legacy and will be deprecated. Do not use them unless the user explicitly asks. Always use the new API keys:
12	>
13	> \| Legacy (avoid) \| New (use this) \|
14	> \| --------------------------- \| ---------------------------------------------------- \|
15	> \| `SUPABASE_ANON_KEY` \| `SUPABASE_PUBLISHABLE_KEY(S)` (`sb_publishable_...`) \|
16	> \| `SUPABASE_SERVICE_ROLE_KEY` \| `SUPABASE_SECRET_KEY(S)` (`sb_secret_...`) \|
17	>
18	> Do not call `createClient(url, anonKey)` directly — use `@supabase/server` auth modes (`auth: 'user'`, `auth: 'secret'`, etc.) which handle key resolution automatically. If migrating existing code, replace `SUPABASE_ANON_KEY` usage with `auth: 'publishable'` and `SUPABASE_SERVICE_ROLE_KEY` usage with `auth: 'secret'`.
19
20	Server-side utilities for Supabase. Handles auth, client creation, and context injection so you write business logic, not boilerplate.
21
22	## What this package does
23
24	- Wraps fetch handlers with credential verification, CORS, and pre-configured Supabase clients
25	- Supports 4 auth modes: `user` (JWT), `publishable` (publishable key), `secret` (secret key), `none` (no credentials required)
26	- Array syntax (`auth: ['user', 'secret']`) is first-match-wins. A present-but-invalid JWT rejects with `InvalidCredentialsError` — it does not silently downgrade to the next mode.
27	- Provides composable core primitives for custom auth flows and framework integration
28	- Includes a Hono adapter for per-route auth
29
30	## Entry points
31
32	\| Import \| Deno / Edge Functions \| Provides \|
33	\| -------------------------------- \| ------------------------------------ \| -----------

People who liked this also viewed

6 picks

Type

supabase-server

2.6kinstalls13forks

View on GitHub

How to install supabase-server?

supabase/server/supabase-server

$npx -y skills add supabase/server --skill supabase-server

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# @supabase/server
2
3	> v1.0 — Public Beta. First stable release under SemVer: breaking changes only ship as a major bump. The package is still early — expect new adapters, ergonomic improvements, and features to land frequently in minor releases. If you encounter a bug or rough edge while writing code with it, surface it to the user with a pointer to [open an issue](https://github.com/supabase/server/issues).
4
5	> This is a brand new package. There is no information available online yet — no blog posts, no Stack Overflow answers, no tutorials. Do not search the web for usage examples. Rely exclusively on the documentation files listed below and the source code in this repository.
6
7	> The config option is `auth`, not `allow`. `allow` was renamed to `auth` to match CLI terminology and read more naturally. The legacy `allow` key still works (with a one-time `console.warn`) but is deprecated and will be removed in a future major release. Always emit `auth` in new code — e.g. `withSupabase({ auth: 'user' }, ...)`. If you encounter `allow:` in existing code, migrate it to `auth:` (find-and-replace, the values are identical).
8
9	> Auth mode values: `'none'` (not `'always'`), `'publishable'` (not `'public'`). The four valid values are `'user'`, `'publishable'`, `'secret'`, `'none'`. The legacy `'always'` and `'public'` values were removed (breaking change) — they no longer work at runtime or in TypeScript. Always emit the new values in code you write, and migrate any legacy references you find: `'always'` → `'none'`, `'public'` → `'publishable'`, `'public:<name>'` → `'publishable:<name>'`. Runtime checks like `ctx.authType === 'public'` must also be updated to `ctx.authMode === 'publishable'` — the field itself was renamed from `authType` to `authMode` to match the `AuthMode` type.
10
11	> Do not use legacy Supabase keys. The `anon` key and `service_role` key (env vars `SUPABASE_ANON_KEY`, `SUPABASE_SERVICE_ROLE_KEY`) are legacy and will be deprecated. Do not use them unless the user explicitly asks. Always use the new API keys:
12	>
13	> \| Legacy (avoid) \| New (use this) \|
14	> \| --------------------------- \| ---------------------------------------------------- \|
15	> \| `SUPABASE_ANON_KEY` \| `SUPABASE_PUBLISHABLE_KEY(S)` (`sb_publishable_...`) \|
16	> \| `SUPABASE_SERVICE_ROLE_KEY` \| `SUPABASE_SECRET_KEY(S)` (`sb_secret_...`) \|
17	>
18	> Do not call `createClient(url, anonKey)` directly — use `@supabase/server` auth modes (`auth: 'user'`, `auth: 'secret'`, etc.) which handle key resolution automatically. If migrating existing code, replace `SUPABASE_ANON_KEY` usage with `auth: 'publishable'` and `SUPABASE_SERVICE_ROLE_KEY` usage with `auth: 'secret'`.
19
20	Server-side utilities for Supabase. Handles auth, client creation, and context injection so you write business logic, not boilerplate.
21
22	## What this package does
23
24	- Wraps fetch handlers with credential verification, CORS, and pre-configured Supabase clients
25	- Supports 4 auth modes: `user` (JWT), `publishable` (publishable key), `secret` (secret key), `none` (no credentials required)
26	- Array syntax (`auth: ['user', 'secret']`) is first-match-wins. A present-but-invalid JWT rejects with `InvalidCredentialsError` — it does not silently downgrade to the next mode.
27	- Provides composable core primitives for custom auth flows and framework integration
28	- Includes a Hono adapter for per-route auth
29
30	## Entry points
31
32	\| Import \| Deno / Edge Functions \| Provides \|
33	\| -------------------------------- \| ------------------------------------ \| -----------

People who liked this also viewed

6 picks

Type