supabase-patterns

To prevent your Supabase service role key from being exposed, enforce locked client factories that restrict admin context to server-side API routes. Never import createSupabaseAdminClient in browser pages, ensuring the service role key stays server-only.

Enforcing Supabase RLS across browser and server contexts requires using specific client factories for each environment. Use getSupabaseClient for browser pages and createSupabaseServerClient for API routes to maintain user security boundaries.

Yes, you need separate Supabase client factories for browser, server, and admin tasks to maintain strict security boundaries. Using getSupabaseClient, createSupabaseServerClient, and createSupabaseAdminClient prevents misconfigurations and enforces RLS discipline.

Secure Supabase patterns in Next.js require documented environment variables for browser, server, and admin contexts. You must locate and configure these env-vars correctly before wiring up the allowed client factories to prevent exposing sensitive keys.

Your Supabase admin client bypasses RLS policies because it uses the service role key, which is designed for privileged operations. To maintain safe patterns, restrict createSupabaseAdminClient usage strictly to server-side contexts where RLS is intentionally bypassed.

The best way to audit a Next.js project for unsafe Supabase client usage is to locate getSupabaseClient, createSupabaseServerClient, and createSupabaseAdminClient imports. Verify each factory operates in its correct browser, server, or admin context.