Auth modes, CORS, and environment overrides. See WithSupabaseConfig.
Receives the Request and a fully-initialized SupabaseContext.
A fetch handler. The optional second parameter is the host's
platform argument (a Workers env, a Deno ServeHandlerInfo) — when the
runtime supplies one, it is captured as the platform env behind
@supabase/middleware's getEnv for any composed middleware.
Variant that accepts a middleware array — each withFoo(config) call
returns an Entry from @supabase/middleware. Middleware run after
the Supabase context is established; they receive ctx.supabase,
ctx.userClaims, etc. already present and contribute their own typed keys
on top. (This is the server leg of a Plugin: the package's middleware goes
here; its client namespace goes in createClient's plugins array.)
import { withSupabase } from '@supabase/server'
import { withGuestbook } from '@supabase/plugin-guestbook/server'
import { withRateLimit } from '@supabase/plugin-rate-limit/server'
export default {
fetch: withSupabase(
{ auth: 'user', middleware: [withRateLimit({ rpm: 100 }), withGuestbook()] },
async (req, ctx) => {
ctx.supabase // from @supabase/server
ctx.rateLimit // from withRateLimit
ctx.guestbook // from withGuestbook
return Response.json(await ctx.guestbook.list())
},
),
}
Type note. MiddlewareCtx<Entries> accumulates the key contributions of
the middleware array. Middleware that declare In prerequisites on
Supabase-provided keys (supabase, userClaims, …) satisfy those at runtime
(the Supabase context is merged before the middleware run) but not at the
type level — a full implementation would widen the prerequisite-validation
seed to include SupabaseContext. Ordering and collision checks within the
middleware array work normally via @supabase/middleware's runtime chain.
Wraps a request handler with Supabase auth, client creation, and CORS handling.
Built for the Web API
Request/Responsestandard that all modern runtimes implement natively. Handles CORS preflight, credential verification, context creation, and error responses. Your handler only runs on successful auth.