@supabase/server - v1.4.0
    Preparing search index...

    Interface WithSupabaseConfig

    Configuration for withSupabase and createSupabaseContext.

    Controls which auth modes are accepted, environment overrides, and CORS behavior.

    // Require authenticated users, auto-CORS enabled (default)
    const config: WithSupabaseConfig = { auth: 'user' }

    // Accept users or service-to-service calls, custom CORS headers
    const config: WithSupabaseConfig = {
      auth: ['user', 'secret'],
      cors: { 'Access-Control-Allow-Origin': 'https://myapp.com' },
    }

    // No auth required, CORS disabled
    const config: WithSupabaseConfig = { auth: 'none', cors: 'disabled' }
    interface WithSupabaseConfig {
        auth?: AuthModeWithKey | AuthModeWithKey[];
        allow?: AuthModeWithKey | AuthModeWithKey[];
        env?: Partial<SupabaseEnv>;
        cors?:
            | boolean
            | Record<string, string>
            | "default"
            | "disabled"
            | { headers: Record<string, string> };
        supabaseOptions?: SupabaseClientOptions<string>;
    }
    Index

    Properties

    auth? allow? env? cors? supabaseOptions?

    Properties

    auth?: AuthModeWithKey | AuthModeWithKey[]

    Auth mode(s) to accept. Modes are tried in order — the first match wins. A mode falls through only when its credential is absent; a present-but-invalid JWT short-circuits the chain with InvalidCredentialsError.

    "user"

    allow?: AuthModeWithKey | AuthModeWithKey[]

    Use WithSupabaseConfig.auth instead. The allow option is kept for backward compatibility and will be removed in a future major release. When both auth and allow are provided, auth takes precedence.

    env?: Partial<SupabaseEnv>

    Override auto-detected environment variables. Useful for testing or when running in environments without standard env var support.

    cors?:
        | boolean
        | Record<string, string>
        | "default"
        | "disabled"
        | { headers: Record<string, string> }

    CORS configuration for the withSupabase wrapper.

    • 'default' — uses @supabase/supabase-js default CORS headers.
    • 'disabled' — disables CORS handling entirely.
    • { headers } — custom CORS headers.

    The boolean (true/false) and bare Record<string, string> forms are deprecated but still accepted for backward compatibility.

    Only applies to the top-level withSupabase wrapper. The adapters (Hono, H3, Elysia, NestJS) handle CORS separately via each framework's own middleware.

    'default'

    supabaseOptions?: SupabaseClientOptions<string>

    Options forwarded to both internal createClient() calls.

    accessToken is stripped, and auth settings (persistSession, autoRefreshToken, detectSessionInUrl) are force-overwritten to server-safe values.

    withSupabase({
      auth: 'user',
      supabaseOptions: { db: { schema: 'api' } },
    }, handler)

    Settings

    Member Visibility

    On This Page

    Properties