Skip to main content

Supabase

Use Supabase for PostgreSQL, authentication, storage, realtime features, and APIs when the generated app needs a hosted backend.

Example apps​

Supabase works well for:

  • CRM systems with clients, projects, and notes.
  • Ecommerce apps with products, orders, and customers.
  • Social apps with posts, comments, likes, and profiles.
  • Booking systems with appointments and calendars.
  • Content apps with files, images, and published pages.

Decide what Supabase owns​

Before implementation, decide whether Supabase will provide:

  • PostgreSQL tables.
  • Authentication.
  • Storage buckets.
  • Row Level Security policies.
  • Realtime subscriptions.
  • Edge functions.
Supabase public product page
Plan the Supabase project and data model before connecting it to a generated app.
SUPABASE_URL=
SUPABASE_ANON_KEY=
SUPABASE_SERVICE_ROLE_KEY=

Use SUPABASE_ANON_KEY only with Row Level Security policies that protect data correctly. Keep SUPABASE_SERVICE_ROLE_KEY on the server only.

Create a Supabase project​

  1. Create a Supabase account.
  2. Choose New project.
  3. Give the project a clear development name.
  4. Generate and store the database password securely.
  5. Choose the region closest to your users.
  6. Start on the free plan while validating the app.
  7. Wait for the project to finish provisioning.

After provisioning, collect the project URL and API keys from project settings. Do not publish screenshots that reveal service-role keys or database passwords.

Database setup​

Ask Cocoding AI to generate SQL for the app data model, then review it before running it in Supabase.

Create Supabase SQL tables for customers, projects, tasks, comments, and files.
Enable Row Level Security.
Add policies so users can only read and update their own workspace records.
Use server-side operations for admin-only actions.

Storage setup​

When the generated app needs images, PDFs, invoices, or avatars:

  1. Create a storage bucket.
  2. Decide whether files are public or private.
  3. Add MIME type and file size validation.
  4. Add RLS/storage policies.
  5. Store file URLs or object paths in the database.

Prompt Cocoding AI​

Connect this app to Supabase.
Use SUPABASE_URL and SUPABASE_ANON_KEY for browser-safe reads that respect RLS.
Use SUPABASE_SERVICE_ROLE_KEY only on the server for admin operations.
Create tables for customers, tickets, and ticket comments.
Add setup errors when Supabase variables are missing.

Test Supabase​

  1. Create development tables and policies.
  2. Store the Supabase URL and keys in runtime configuration.
  3. Open the Cocoding AI preview.
  4. Create one safe test record.
  5. Confirm the record appears in Supabase.
  6. Test unauthorized access if Row Level Security is enabled.

Troubleshooting​

SymptomLikely causeWhat to check
Request deniedRLS policy missing or too strictReview table policies for the current user role.
Data visible to everyoneRLS disabled or policy too broadEnable RLS and use least-privilege policies.
Service role exposedUnsafe client codeMove service-role operations to backend routes.
Storage upload failsBucket policy mismatchCheck bucket permissions and allowed MIME types.