{ "schemaVersion": "2.0", "id": 0, "name": "@supabase/server", "variant": "project", "kind": 1, "flags": {}, "children": [ { "id": 14, "name": "adapters/elysia", "variant": "declaration", "kind": 2, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Elysia framework adapter for " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": "." } ] }, "children": [ { "id": 211, "name": "SupabaseError", "variant": "declaration", "kind": 128, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Wraps an " }, { "kind": "inline-tag", "tag": "@link", "text": "AuthError", "target": 101 }, { "kind": "text", "text": " as an Elysia-compatible error.\n\nDiscriminate in " }, { "kind": "code", "text": "`onError`" }, { "kind": "text", "text": " via " }, { "kind": "code", "text": "`code === 'SupabaseError'`" }, { "kind": "text", "text": ". The original\n" }, { "kind": "code", "text": "`AuthError`" }, { "kind": "text", "text": " is available as the typed " }, { "kind": "code", "text": "`.cause`" }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Adapters" } ] } ] }, "children": [ { "id": 215, "name": "status", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 16, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L16" } ], "type": { "type": "intrinsic", "name": "number" } }, { "id": 216, "name": "cause", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 17, "character": 10, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L17" } ], "type": { "type": "reference", "target": 101, "name": "AuthError", "package": "@supabase/server" }, "overwrites": { "type": "reference", "target": -1, "name": "Error.cause" } }, { "id": 212, "name": "constructor", "variant": "declaration", "kind": 512, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 18, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L18" } ], "signatures": [ { "id": 213, "name": "SupabaseError", "variant": "signature", "kind": 16384, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 18, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L18" } ], "parameters": [ { "id": 214, "name": "inner", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "reference", "target": 101, "name": "AuthError", "package": "@supabase/server" } } ], "type": { "type": "reference", "target": 211, "name": "SupabaseError", "package": "@supabase/server" }, "overwrites": { "type": "reference", "target": -1, "name": "Error.constructor", "package": "typescript" } } ], "overwrites": { "type": "reference", "target": -1, "name": "Error.constructor", "package": "typescript" } } ], "groups": [ { "title": "Constructors", "children": [ 212 ] }, { "title": "Properties", "children": [ 215, 216 ] } ], "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 15, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L15" } ], "extendedTypes": [ { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Error" }, "name": "Error", "package": "typescript" } ] }, { "id": 217, "name": "withSupabase", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 73, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L73" } ], "signatures": [ { "id": 218, "name": "withSupabase", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Elysia plugin that creates a " }, { "kind": "inline-tag", "tag": "@link", "text": "SupabaseContext", "target": 74 }, { "kind": "text", "text": " and makes it available in route handlers.\n\nSkips if a previous plugin already set the context, enabling route-level overrides.\nThrows a " }, { "kind": "code", "text": "`SupabaseError`" }, { "kind": "text", "text": " on auth failure. " }, { "kind": "code", "text": "`.status`" }, { "kind": "text", "text": " is on the error directly; the original\n" }, { "kind": "code", "text": "`AuthError`" }, { "kind": "text", "text": " is available as the typed " }, { "kind": "code", "text": "`.cause`" }, { "kind": "text", "text": ". Discriminate in " }, { "kind": "code", "text": "`onError`" }, { "kind": "text", "text": " via " }, { "kind": "code", "text": "`code === 'SupabaseError'`" }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@returns", "content": [ { "kind": "text", "text": "An Elysia plugin that exposes " }, { "kind": "code", "text": "`supabaseContext`" }, { "kind": "text", "text": "." } ] }, { "tag": "@example", "name": "App-wide auth via .use()", "content": [ { "kind": "code", "text": "```ts\nimport { Elysia } from 'elysia'\nimport { withSupabase } from '@supabase/server/adapters/elysia'\n\nconst app = new Elysia()\n .use(withSupabase({ auth: 'user' }))\n .get('/games', async ({ supabaseContext }) => {\n const { data } = await supabaseContext.supabase.from('favorite_games').select()\n return data\n })\n\napp.listen(3000)\n```" } ] }, { "tag": "@example", "name": "Per-route auth via scoped .use()", "content": [ { "kind": "code", "text": "```ts\nimport { Elysia } from 'elysia'\nimport { withSupabase } from '@supabase/server/adapters/elysia'\n\nconst app = new Elysia()\n .get('/health', () => ({ status: 'ok' }))\n .group('/api', (app) =>\n app\n .use(withSupabase({ auth: 'user' }))\n .get('/profile', async ({ supabaseContext }) => {\n return supabaseContext.userClaims\n })\n )\n\napp.listen(3000)\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Adapters" } ] } ] }, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 73, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L73" } ], "parameters": [ { "id": 219, "name": "config", "variant": "param", "kind": 32768, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Auth modes and optional environment overrides. CORS is excluded — use Elysia's CORS utilities." } ] }, "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Omit" }, "typeArguments": [ { "type": "reference", "target": 93, "name": "WithSupabaseConfig", "package": "@supabase/server" }, { "type": "literal", "value": "cors" } ], "name": "Omit", "package": "typescript" } } ], "type": { "type": "reference", "target": { "packageName": "elysia", "packagePath": "dist/index.d.ts", "qualifiedName": "default" }, "typeArguments": [ { "type": "literal", "value": "" }, { "type": "reflection", "declaration": { "id": 220, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 221, "name": "decorator", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 75, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L75" } ], "type": { "type": "reflection", "declaration": { "id": 222, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 223, "name": "store", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 75, "character": 19, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L75" } ], "type": { "type": "reflection", "declaration": { "id": 224, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 225, "name": "derive", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 75, "character": 30, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L75" } ], "type": { "type": "reflection", "declaration": { "id": 226, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 227, "name": "resolve", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 75, "character": 42, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L75" } ], "type": { "type": "reflection", "declaration": { "id": 228, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } } ], "groups": [ { "title": "Properties", "children": [ 221, 223, 225, 227 ] } ] } }, { "type": "reflection", "declaration": { "id": 229, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 230, "name": "typebox", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 76, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L76" } ], "type": { "type": "reflection", "declaration": { "id": 231, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 232, "name": "error", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 76, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L76" } ], "type": { "type": "reflection", "declaration": { "id": 233, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 234, "name": "SupabaseError", "variant": "declaration", "kind": 1024, "flags": { "isReadonly": true }, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 76, "character": 35, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L76" } ], "type": { "type": "reference", "target": 211, "name": "SupabaseError", "package": "@supabase/server" } } ], "groups": [ { "title": "Properties", "children": [ 234 ] } ] } } } ], "groups": [ { "title": "Properties", "children": [ 230, 232 ] } ] } }, { "type": "reflection", "declaration": { "id": 235, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 236, "name": "schema", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 78, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L78" } ], "type": { "type": "reflection", "declaration": { "id": 237, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 238, "name": "standaloneSchema", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 79, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L79" } ], "type": { "type": "reflection", "declaration": { "id": 239, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 240, "name": "macro", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 80, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L80" } ], "type": { "type": "reflection", "declaration": { "id": 241, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 242, "name": "macroFn", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 81, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L81" } ], "type": { "type": "reflection", "declaration": { "id": 243, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 244, "name": "parser", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 82, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L82" } ], "type": { "type": "reflection", "declaration": { "id": 245, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 246, "name": "response", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 83, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L83" } ], "type": { "type": "reflection", "declaration": { "id": 247, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } } ], "groups": [ { "title": "Properties", "children": [ 236, 238, 240, 242, 244, 246 ] } ] } }, { "type": "reflection", "declaration": { "id": 248, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } }, { "type": "reflection", "declaration": { "id": 249, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 250, "name": "derive", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 87, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L87" } ], "type": { "type": "reflection", "declaration": { "id": 251, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 252, "name": "resolve", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 88, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L88" } ], "type": { "type": "reflection", "declaration": { "id": 253, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 254, "name": "supabaseContext", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 88, "character": 15, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L88" } ], "type": { "type": "reference", "target": 74, "name": "SupabaseContext", "package": "@supabase/server" } } ], "groups": [ { "title": "Properties", "children": [ 254 ] } ] } } }, { "id": 255, "name": "schema", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 89, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L89" } ], "type": { "type": "reflection", "declaration": { "id": 256, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 257, "name": "standaloneSchema", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 90, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L90" } ], "type": { "type": "reflection", "declaration": { "id": 258, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 259, "name": "response", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 91, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L91" } ], "type": { "type": "reference", "target": { "packageName": "elysia", "packagePath": "dist/types.d.ts", "qualifiedName": "ExtractErrorFromHandle" }, "typeArguments": [ { "type": "reflection", "declaration": { "id": 260, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 261, "name": "supabaseContext", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 91, "character": 39, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L91" } ], "type": { "type": "reference", "target": 74, "name": "SupabaseContext", "package": "@supabase/server" } } ], "groups": [ { "title": "Properties", "children": [ 261 ] } ] } } ], "name": "ExtractErrorFromHandle", "package": "elysia" } } ], "groups": [ { "title": "Properties", "children": [ 250, 252, 255, 257, 259 ] } ] } }, { "type": "reflection", "declaration": { "id": 262, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 263, "name": "derive", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 94, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L94" } ], "type": { "type": "reflection", "declaration": { "id": 264, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 265, "name": "resolve", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 95, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L95" } ], "type": { "type": "reflection", "declaration": { "id": 266, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 267, "name": "schema", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 96, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L96" } ], "type": { "type": "reflection", "declaration": { "id": 268, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 269, "name": "standaloneSchema", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 97, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L97" } ], "type": { "type": "reflection", "declaration": { "id": 270, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } }, { "id": 271, "name": "response", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/elysia/plugin.ts", "line": 98, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/plugin.ts#L98" } ], "type": { "type": "reflection", "declaration": { "id": 272, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {} } } } ], "groups": [ { "title": "Properties", "children": [ 263, 265, 267, 269, 271 ] } ] } } ], "name": "Elysia", "package": "elysia", "qualifiedName": "default" } } ] } ], "groups": [ { "title": "Classes", "children": [ 211 ], "categories": [ { "title": "Adapters", "children": [ 211 ] } ] }, { "title": "Functions", "children": [ 217 ], "categories": [ { "title": "Adapters", "children": [ 217 ] } ] } ], "sources": [ { "fileName": "adapters/elysia/index.ts", "line": 1, "character": 0, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/elysia/index.ts#L1" } ] }, { "id": 13, "name": "adapters/h3", "variant": "declaration", "kind": 2, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "H3 framework adapter for " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": "." } ] }, "children": [ { "id": 208, "name": "withSupabase", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "adapters/h3/middleware.ts", "line": 48, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/h3/middleware.ts#L48" } ], "signatures": [ { "id": 209, "name": "withSupabase", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "H3 middleware that creates a " }, { "kind": "inline-tag", "tag": "@link", "text": "SupabaseContext", "target": 74 }, { "kind": "text", "text": " and stores it in " }, { "kind": "code", "text": "`event.context.supabaseContext`" }, { "kind": "text", "text": ".\n\nSkips if a previous middleware already set the context, enabling chained middleware via " }, { "kind": "code", "text": "`app.use()`" }, { "kind": "text", "text": ".\nThrows an " }, { "kind": "code", "text": "`HTTPError`" }, { "kind": "text", "text": " on auth failure." } ], "blockTags": [ { "tag": "@returns", "content": [ { "kind": "text", "text": "An H3 middleware." } ] }, { "tag": "@example", "name": "App-wide auth via app.use()", "content": [ { "kind": "code", "text": "```ts\nimport { H3 } from 'h3'\nimport { withSupabase } from '@supabase/server/adapters/h3'\n\nconst app = new H3()\napp.use(withSupabase({ auth: 'user' }))\n\napp.get('/games', async (event) => {\n const { supabase } = event.context.supabaseContext\n return supabase.from('favorite_games').select()\n})\n\nexport default { fetch: app.fetch }\n```" } ] }, { "tag": "@example", "name": "Per-route auth via defineHandler", "content": [ { "kind": "code", "text": "```ts\nimport { defineHandler } from 'h3'\nimport { withSupabase } from '@supabase/server/adapters/h3'\n\nexport default defineHandler({\n middleware: [withSupabase({ auth: 'user' })],\n handler: async (event) => {\n const { supabase } = event.context.supabaseContext\n return supabase.from('favorite_games').select()\n },\n})\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Adapters" } ] } ] }, "sources": [ { "fileName": "adapters/h3/middleware.ts", "line": 48, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/h3/middleware.ts#L48" } ], "parameters": [ { "id": 210, "name": "config", "variant": "param", "kind": 32768, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Auth modes and optional environment overrides. CORS is excluded — use H3's CORS utilities." } ] }, "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Omit" }, "typeArguments": [ { "type": "reference", "target": 93, "name": "WithSupabaseConfig", "package": "@supabase/server" }, { "type": "literal", "value": "cors" } ], "name": "Omit", "package": "typescript" } } ], "type": { "type": "reference", "target": { "packageName": "h3", "packagePath": "dist/h3-D76FUMrE.d.mts", "qualifiedName": "Middleware" }, "name": "Middleware", "package": "h3" } } ] } ], "groups": [ { "title": "Functions", "children": [ 208 ], "categories": [ { "title": "Adapters", "children": [ 208 ] } ] } ], "sources": [ { "fileName": "adapters/h3/index.ts", "line": 1, "character": 0, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/h3/index.ts#L1" } ] }, { "id": 12, "name": "adapters/hono", "variant": "declaration", "kind": 2, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Hono framework adapter for " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": "." } ] }, "children": [ { "id": 201, "name": "withSupabase", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "adapters/hono/middleware.ts", "line": 43, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/hono/middleware.ts#L43" } ], "signatures": [ { "id": 202, "name": "withSupabase", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Hono middleware that creates a " }, { "kind": "inline-tag", "tag": "@link", "text": "SupabaseContext", "target": 74 }, { "kind": "text", "text": " and stores it in " }, { "kind": "code", "text": "`c.var.supabaseContext`" }, { "kind": "text", "text": ".\n\nSkips if a previous middleware already set the context, enabling route-level overrides.\nThrows a Hono " }, { "kind": "code", "text": "`HTTPException`" }, { "kind": "text", "text": " on auth failure." } ], "blockTags": [ { "tag": "@returns", "content": [ { "kind": "text", "text": "A Hono middleware that sets " }, { "kind": "code", "text": "`c.var.supabaseContext`" }, { "kind": "text", "text": "." } ] }, { "tag": "@example", "name": "App-wide auth via app.use()", "content": [ { "kind": "code", "text": "```ts\nimport { Hono } from 'hono'\nimport { withSupabase } from '@supabase/server/adapters/hono'\nimport type { SupabaseContext } from '@supabase/server'\n\ntype Env = {\n Variables: {\n supabaseContext: SupabaseContext\n }\n}\n\nconst app = new Hono()\napp.use('*', withSupabase({ auth: 'user' }))\n\napp.get('/profile', async (c) => {\n const { supabase } = c.var.supabaseContext\n const { data } = await supabase.rpc('get_profile')\n return c.json(data)\n})\n\nexport default { fetch: app.fetch }\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Adapters" } ] } ] }, "sources": [ { "fileName": "adapters/hono/middleware.ts", "line": 43, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/hono/middleware.ts#L43" } ], "parameters": [ { "id": 203, "name": "config", "variant": "param", "kind": 32768, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Auth modes and optional environment overrides. CORS is excluded — use Hono's " }, { "kind": "code", "text": "`cors()`" }, { "kind": "text", "text": "." } ] }, "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Omit" }, "typeArguments": [ { "type": "reference", "target": 93, "name": "WithSupabaseConfig", "package": "@supabase/server" }, { "type": "literal", "value": "cors" } ], "name": "Omit", "package": "typescript" } } ], "type": { "type": "reference", "target": { "packageName": "hono", "packagePath": "dist/types/types.d.ts", "qualifiedName": "MiddlewareHandler" }, "typeArguments": [ { "type": "reflection", "declaration": { "id": 204, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 205, "name": "Variables", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/hono/middleware.ts", "line": 45, "character": 23, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/hono/middleware.ts#L45" } ], "type": { "type": "reflection", "declaration": { "id": 206, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 207, "name": "supabaseContext", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "adapters/hono/middleware.ts", "line": 45, "character": 36, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/hono/middleware.ts#L45" } ], "type": { "type": "reference", "target": 74, "name": "SupabaseContext", "package": "@supabase/server" } } ], "groups": [ { "title": "Properties", "children": [ 207 ] } ] } } } ], "groups": [ { "title": "Properties", "children": [ 205 ] } ] } } ], "name": "MiddlewareHandler", "package": "hono" } } ] } ], "groups": [ { "title": "Functions", "children": [ 201 ], "categories": [ { "title": "Adapters", "children": [ 201 ] } ] } ], "sources": [ { "fileName": "adapters/hono/index.ts", "line": 1, "character": 0, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/adapters/hono/index.ts#L1" } ] }, { "id": 11, "name": "core", "variant": "declaration", "kind": 2, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Composable primitives for constructing a " }, { "kind": "inline-tag", "tag": "@link", "text": "index.SupabaseContext", "target": 74 }, { "kind": "text", "text": "." } ] }, "children": [ { "id": 194, "name": "createAdminClient", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "core/create-admin-client.ts", "line": 42, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/create-admin-client.ts#L42" } ], "signatures": [ { "id": 195, "name": "createAdminClient", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Creates an admin Supabase client that bypasses Row-Level Security.\n\nUses a secret key for authentication, giving full access to all data.\nStateless — one client per request.\n\n## Which key is used\n\nWith " }, { "kind": "code", "text": "`auth.keyName`" }, { "kind": "text", "text": " set, that named key from " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": " is used —\nand it throws if the key doesn't exist. With " }, { "kind": "code", "text": "`keyName`" }, { "kind": "text", "text": " omitted, the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": "\nkey is used, falling back to the first key in the set when no " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " exists.\n\nNote this differs from the " }, { "kind": "code", "text": "`\"secret\"`" }, { "kind": "text", "text": " auth mode, which matches the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": "\nkey only and never falls back — see " }, { "kind": "inline-tag", "tag": "@link", "text": "index.AuthModeWithKey", "target": 41 }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@throws", "content": [ { "kind": "inline-tag", "tag": "@link", "text": "index.EnvError", "target": 111 }, { "kind": "text", "text": " If " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " is missing or the specified secret key is not found." } ] }, { "tag": "@example", "name": "Basic usage", "content": [ { "kind": "code", "text": "```ts\n// Uses the `default` secret key (or the first key if no `default` exists)\nconst supabaseAdmin = createAdminClient()\nconst { data } = await supabaseAdmin.from('audit_log').insert({ action: 'user_login' })\n```" } ] }, { "tag": "@example", "name": "Specific named key", "content": [ { "kind": "code", "text": "```ts\nconst supabaseAdmin = createAdminClient({ auth: { keyName: 'internal' } })\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Primitives" } ] } ] }, "sources": [ { "fileName": "core/create-admin-client.ts", "line": 42, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/create-admin-client.ts#L42" } ], "typeParameters": [ { "id": 196, "name": "Database", "variant": "typeParam", "kind": 131072, "flags": {}, "default": { "type": "intrinsic", "name": "unknown" } } ], "parameters": [ { "id": 197, "name": "options", "variant": "param", "kind": 32768, "flags": { "isOptional": true }, "type": { "type": "reference", "target": 51, "name": "CreateAdminClientOptions", "package": "@supabase/server" } } ], "type": { "type": "reference", "target": { "packageName": "@supabase/supabase-js", "packagePath": "src/lib/rest/types/common/common.ts", "qualifiedName": "SupabaseClient" }, "typeArguments": [ { "type": "reference", "target": 196, "name": "Database", "package": "@supabase/server", "refersToTypeParameter": true } ], "name": "SupabaseClient", "package": "@supabase/supabase-js" } } ] }, { "id": 190, "name": "createContextClient", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "core/create-context-client.ts", "line": 40, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/create-context-client.ts#L40" } ], "signatures": [ { "id": 191, "name": "createContextClient", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Creates a Supabase client scoped to the caller's context.\n\nConfigured with a publishable key and (optionally) the caller's JWT,\nso Row-Level Security policies apply. Stateless — one client per request.\n\n## Which key is used\n\nWith " }, { "kind": "code", "text": "`auth.keyName`" }, { "kind": "text", "text": " set, that named key from " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " is\nused — and it throws if the key doesn't exist. With " }, { "kind": "code", "text": "`keyName`" }, { "kind": "text", "text": " omitted, the\n" }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key is used, falling back to the first key in the set when no\n" }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " exists.\n\nNote this differs from the " }, { "kind": "code", "text": "`\"publishable\"`" }, { "kind": "text", "text": " auth mode, which matches the\n" }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key only and never falls back — see " }, { "kind": "inline-tag", "tag": "@link", "text": "index.AuthModeWithKey", "target": 41 }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@throws", "content": [ { "kind": "inline-tag", "tag": "@link", "text": "index.EnvError", "target": 111 }, { "kind": "text", "text": " If " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " is missing or the specified publishable key is not found." } ] }, { "tag": "@example", "name": "With verified auth", "content": [ { "kind": "code", "text": "```ts\nconst { data: auth } = await verifyAuth(request, { auth: 'user' })\nconst supabase = createContextClient({\n auth: { token: auth.token, keyName: auth.keyName },\n})\nconst { data } = await supabase.rpc('get_my_items')\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Primitives" } ] } ] }, "sources": [ { "fileName": "core/create-context-client.ts", "line": 40, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/create-context-client.ts#L40" } ], "typeParameters": [ { "id": 192, "name": "Database", "variant": "typeParam", "kind": 131072, "flags": {}, "default": { "type": "intrinsic", "name": "unknown" } } ], "parameters": [ { "id": 193, "name": "options", "variant": "param", "kind": 32768, "flags": { "isOptional": true }, "type": { "type": "reference", "target": 55, "name": "CreateContextClientOptions", "package": "@supabase/server" } } ], "type": { "type": "reference", "target": { "packageName": "@supabase/supabase-js", "packagePath": "src/lib/rest/types/common/common.ts", "qualifiedName": "SupabaseClient" }, "typeArguments": [ { "type": "reference", "target": 192, "name": "Database", "package": "@supabase/server", "refersToTypeParameter": true } ], "name": "SupabaseClient", "package": "@supabase/supabase-js" } } ] }, { "id": 159, "name": "extractCredentials", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "core/extract-credentials.ts", "line": 27, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/extract-credentials.ts#L27" } ], "signatures": [ { "id": 160, "name": "extractCredentials", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Extracts authentication credentials from an incoming HTTP request.\n\nReads two headers:\n- " }, { "kind": "code", "text": "`Authorization: Bearer `" }, { "kind": "text", "text": " → extracted as " }, { "kind": "code", "text": "`token`" }, { "kind": "text", "text": "\n- " }, { "kind": "code", "text": "`apikey: `" }, { "kind": "text", "text": " → extracted as " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": "\n\nThis is a pure extraction step — no validation or verification is performed.\nPass the result to " }, { "kind": "inline-tag", "tag": "@link", "text": "verifyCredentials", "target": 162 }, { "kind": "text", "text": " to validate against allowed auth modes." } ], "blockTags": [ { "tag": "@returns", "content": [ { "kind": "text", "text": "The extracted " }, { "kind": "inline-tag", "tag": "@link", "text": "Credentials", "target": 59 }, { "kind": "text", "text": ". Fields are " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " when the corresponding header is absent." } ] }, { "tag": "@example", "name": "Basic usage", "content": [ { "kind": "code", "text": "```ts\nimport { extractCredentials } from '@supabase/server/core'\n\nconst creds = extractCredentials(request)\nconsole.log(creds.token) // \"eyJhbGci...\" or null\nconsole.log(creds.apikey) // \"sb-abc123-publishable-...\" or null\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Primitives" } ] } ] }, "sources": [ { "fileName": "core/extract-credentials.ts", "line": 27, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/extract-credentials.ts#L27" } ], "parameters": [ { "id": 161, "name": "request", "variant": "param", "kind": 32768, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "The incoming HTTP request." } ] }, "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.dom.d.ts", "qualifiedName": "Request" }, "name": "Request", "package": "typescript" } } ], "type": { "type": "reference", "target": 59, "name": "Credentials", "package": "@supabase/server" } } ] }, { "id": 198, "name": "ClientAuth", "variant": "reference", "kind": 4194304, "flags": {}, "sources": [ { "fileName": "core/index.ts", "line": 17, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/index.ts#L17" } ], "target": 48 }, { "id": 199, "name": "CreateAdminClientOptions", "variant": "reference", "kind": 4194304, "flags": {}, "sources": [ { "fileName": "core/index.ts", "line": 18, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/index.ts#L18" } ], "target": 51 }, { "id": 200, "name": "CreateContextClientOptions", "variant": "reference", "kind": 4194304, "flags": {}, "sources": [ { "fileName": "core/index.ts", "line": 19, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/index.ts#L19" } ], "target": 55 }, { "id": 150, "name": "resolveEnv", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "core/resolve-env.ts", "line": 163, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/resolve-env.ts#L163" } ], "signatures": [ { "id": 151, "name": "resolveEnv", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Resolves Supabase environment configuration from runtime environment variables.\n\nReads " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": ", keys (" }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": "),\nand the JWKS source (" }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " for inline keys, or " }, { "kind": "code", "text": "`SUPABASE_JWKS_URL`" }, { "kind": "text", "text": "\nfor a remote endpoint). Works across Deno, Node.js, and Bun. For Cloudflare\nWorkers, use " }, { "kind": "code", "text": "`overrides`" }, { "kind": "text", "text": " or enable node-compat." } ], "blockTags": [ { "tag": "@returns", "content": [ { "kind": "code", "text": "`{ data: SupabaseEnv, error: null }`" }, { "kind": "text", "text": " on success, " }, { "kind": "code", "text": "`{ data: null, error: EnvError }`" }, { "kind": "text", "text": " on failure." } ] }, { "tag": "@example", "name": "Reading and overriding env vars", "content": [ { "kind": "code", "text": "```ts\nconst { data: env, error } = resolveEnv()\nif (error) throw error\n\n// Override for tests\nconst { data: env } = resolveEnv({ url: 'http://localhost:54321' })\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Primitives" } ] } ] }, "sources": [ { "fileName": "core/resolve-env.ts", "line": 163, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/resolve-env.ts#L163" } ], "parameters": [ { "id": 152, "name": "overrides", "variant": "param", "kind": 32768, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Partial values that take precedence over env vars." } ] }, "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Partial" }, "typeArguments": [ { "type": "reference", "target": 82, "name": "SupabaseEnv", "package": "@supabase/server" } ], "name": "Partial", "package": "typescript" } } ], "type": { "type": "union", "types": [ { "type": "reflection", "declaration": { "id": 153, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 154, "name": "data", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/resolve-env.ts", "line": 165, "character": 5, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/resolve-env.ts#L165" } ], "type": { "type": "reference", "target": 82, "name": "SupabaseEnv", "package": "@supabase/server" } }, { "id": 155, "name": "error", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/resolve-env.ts", "line": 165, "character": 24, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/resolve-env.ts#L165" } ], "type": { "type": "literal", "value": null } } ], "groups": [ { "title": "Properties", "children": [ 154, 155 ] } ] } }, { "type": "reflection", "declaration": { "id": 156, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 157, "name": "data", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/resolve-env.ts", "line": 165, "character": 42, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/resolve-env.ts#L165" } ], "type": { "type": "literal", "value": null } }, { "id": 158, "name": "error", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/resolve-env.ts", "line": 165, "character": 54, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/resolve-env.ts#L165" } ], "type": { "type": "reference", "target": 111, "name": "EnvError", "package": "@supabase/server" } } ], "groups": [ { "title": "Properties", "children": [ 157, 158 ] } ] } } ] } } ] }, { "id": 186, "name": "VerifyAuthOptions", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Options for " }, { "kind": "inline-tag", "tag": "@link", "text": "verifyAuth", "target": 176 }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Primitives" } ] } ] }, "children": [ { "id": 187, "name": "auth", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Auth mode(s) to try. Modes are attempted in order — the first match wins." } ], "blockTags": [ { "tag": "@see", "content": [ { "kind": "inline-tag", "tag": "@link", "text": "AuthModeWithKey", "target": 41 }, { "kind": "text", "text": " for the full syntax including named keys." } ] }, { "tag": "@defaultValue", "content": [ { "kind": "code", "text": "`\"user\"`" } ] } ] }, "sources": [ { "fileName": "core/verify-auth.ts", "line": 18, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-auth.ts#L18" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" }, { "type": "array", "elementType": { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" } } ] } }, { "id": 188, "name": "allow", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [], "blockTags": [ { "tag": "@deprecated", "content": [ { "kind": "text", "text": "Use " }, { "kind": "inline-tag", "tag": "@link", "text": "VerifyAuthOptions.auth", "target": 187 }, { "kind": "text", "text": " instead. Kept for backward\ncompatibility; will be removed in a future major release. When both are\nprovided, " }, { "kind": "code", "text": "`auth`" }, { "kind": "text", "text": " wins." } ] } ] }, "sources": [ { "fileName": "core/verify-auth.ts", "line": 25, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-auth.ts#L25" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" }, { "type": "array", "elementType": { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" } } ] } }, { "id": 189, "name": "env", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Optional environment overrides (passed through to " }, { "kind": "inline-tag", "tag": "@link", "text": "resolveEnv", "target": 150 }, { "kind": "text", "text": ")." } ] }, "sources": [ { "fileName": "core/verify-auth.ts", "line": 28, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-auth.ts#L28" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Partial" }, "typeArguments": [ { "type": "reference", "target": 82, "name": "SupabaseEnv", "package": "@supabase/server" } ], "name": "Partial", "package": "typescript" } } ], "groups": [ { "title": "Properties", "children": [ 187, 188, 189 ] } ], "sources": [ { "fileName": "core/verify-auth.ts", "line": 10, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-auth.ts#L10" } ] }, { "id": 176, "name": "verifyAuth", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "core/verify-auth.ts", "line": 62, "character": 22, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-auth.ts#L62" } ], "signatures": [ { "id": 177, "name": "verifyAuth", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Extracts credentials from a request and verifies them in a single step.\n\nThis is a convenience function that combines " }, { "kind": "inline-tag", "tag": "@link", "text": "extractCredentials", "target": 159 }, { "kind": "text", "text": " and\n" }, { "kind": "inline-tag", "tag": "@link", "text": "verifyCredentials", "target": 162 }, { "kind": "text", "text": ". Use it when you want the full auth flow without\nneeding to inspect the raw credentials." } ], "blockTags": [ { "tag": "@returns", "content": [ { "kind": "text", "text": "A result tuple: " }, { "kind": "code", "text": "`{ data, error }`" }, { "kind": "text", "text": ".\n - On success: " }, { "kind": "code", "text": "`{ data: AuthResult, error: null }`" }, { "kind": "text", "text": "\n - On failure: " }, { "kind": "code", "text": "`{ data: null, error: AuthError }`" } ] }, { "tag": "@example", "name": "User auth", "content": [ { "kind": "code", "text": "```ts\nimport { verifyAuth } from '@supabase/server/core'\n\nconst { data: auth, error } = await verifyAuth(request, {\n auth: 'user',\n})\n\nif (error) {\n return Response.json({ message: error.message }, { status: error.status })\n}\n\nconsole.log(auth.userClaims!.id) // \"d0f1a2b3-...\"\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Primitives" } ] } ] }, "sources": [ { "fileName": "core/verify-auth.ts", "line": 62, "character": 22, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-auth.ts#L62" } ], "parameters": [ { "id": 178, "name": "request", "variant": "param", "kind": 32768, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "The incoming HTTP request." } ] }, "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.dom.d.ts", "qualifiedName": "Request" }, "name": "Request", "package": "typescript" } }, { "id": 179, "name": "options", "variant": "param", "kind": 32768, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Auth modes to accept and optional environment overrides." } ] }, "type": { "type": "reference", "target": 186, "name": "VerifyAuthOptions", "package": "@supabase/server" } } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Promise" }, "typeArguments": [ { "type": "union", "types": [ { "type": "reflection", "declaration": { "id": 180, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 181, "name": "data", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/verify-auth.ts", "line": 66, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-auth.ts#L66" } ], "type": { "type": "reference", "target": 42, "name": "AuthResult", "package": "@supabase/server" } }, { "id": 182, "name": "error", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/verify-auth.ts", "line": 66, "character": 22, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-auth.ts#L66" } ], "type": { "type": "literal", "value": null } } ], "groups": [ { "title": "Properties", "children": [ 181, 182 ] } ] } }, { "type": "reflection", "declaration": { "id": 183, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 184, "name": "data", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/verify-auth.ts", "line": 66, "character": 40, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-auth.ts#L66" } ], "type": { "type": "literal", "value": null } }, { "id": 185, "name": "error", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/verify-auth.ts", "line": 66, "character": 52, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-auth.ts#L66" } ], "type": { "type": "reference", "target": 101, "name": "AuthError", "package": "@supabase/server" } } ], "groups": [ { "title": "Properties", "children": [ 184, 185 ] } ] } } ] } ], "name": "Promise", "package": "typescript" } } ] }, { "id": 172, "name": "VerifyCredentialsOptions", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Options for " }, { "kind": "inline-tag", "tag": "@link", "text": "verifyCredentials", "target": 162 }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Primitives" } ] } ] }, "children": [ { "id": 173, "name": "auth", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Auth mode(s) to try. Modes are attempted in order — the first match wins." } ], "blockTags": [ { "tag": "@see", "content": [ { "kind": "inline-tag", "tag": "@link", "text": "AuthModeWithKey", "target": 41 }, { "kind": "text", "text": " for the full syntax including named keys." } ] }, { "tag": "@defaultValue", "content": [ { "kind": "code", "text": "`\"user\"`" } ] } ] }, "sources": [ { "fileName": "core/verify-credentials.ts", "line": 38, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-credentials.ts#L38" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" }, { "type": "array", "elementType": { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" } } ] } }, { "id": 174, "name": "allow", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [], "blockTags": [ { "tag": "@deprecated", "content": [ { "kind": "text", "text": "Use " }, { "kind": "inline-tag", "tag": "@link", "text": "VerifyCredentialsOptions.auth", "target": 173 }, { "kind": "text", "text": " instead. Kept for\nbackward compatibility; will be removed in a future major release. When\nboth are provided, " }, { "kind": "code", "text": "`auth`" }, { "kind": "text", "text": " wins." } ] } ] }, "sources": [ { "fileName": "core/verify-credentials.ts", "line": 45, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-credentials.ts#L45" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" }, { "type": "array", "elementType": { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" } } ] } }, { "id": 175, "name": "env", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Optional environment overrides (passed through to " }, { "kind": "inline-tag", "tag": "@link", "text": "resolveEnv", "target": 150 }, { "kind": "text", "text": ")." } ] }, "sources": [ { "fileName": "core/verify-credentials.ts", "line": 48, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-credentials.ts#L48" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Partial" }, "typeArguments": [ { "type": "reference", "target": 82, "name": "SupabaseEnv", "package": "@supabase/server" } ], "name": "Partial", "package": "typescript" } } ], "groups": [ { "title": "Properties", "children": [ 173, 174, 175 ] } ], "sources": [ { "fileName": "core/verify-credentials.ts", "line": 30, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-credentials.ts#L30" } ] }, { "id": 162, "name": "verifyCredentials", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "core/verify-credentials.ts", "line": 311, "character": 22, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-credentials.ts#L311" } ], "signatures": [ { "id": 163, "name": "verifyCredentials", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Verifies pre-extracted credentials against one or more allowed auth modes.\n\nTries each mode in order — first match wins. A mode is only tried when its\ncredential is present; a JWT that is present but fails verification\nshort-circuits the chain with " }, { "kind": "code", "text": "`InvalidCredentialsError`" }, { "kind": "text", "text": " instead of falling\nthrough to the next mode. Use " }, { "kind": "inline-tag", "tag": "@link", "text": "verifyAuth", "target": 176 }, { "kind": "text", "text": " to extract and verify in a\nsingle call." } ], "blockTags": [ { "tag": "@returns", "content": [ { "kind": "code", "text": "`{ data: AuthResult, error: null }`" }, { "kind": "text", "text": " on success, " }, { "kind": "code", "text": "`{ data: null, error: AuthError }`" }, { "kind": "text", "text": " on failure." } ] }, { "tag": "@example", "name": "Multiple auth modes", "content": [ { "kind": "code", "text": "```ts\nconst credentials = extractCredentials(request)\nconst { data: auth, error } = await verifyCredentials(credentials, {\n auth: ['user', 'publishable'],\n})\nif (error) {\n return Response.json({ message: error.message }, { status: error.status })\n}\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Primitives" } ] } ] }, "sources": [ { "fileName": "core/verify-credentials.ts", "line": 311, "character": 22, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-credentials.ts#L311" } ], "parameters": [ { "id": 164, "name": "credentials", "variant": "param", "kind": 32768, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "The credentials to verify (from " }, { "kind": "inline-tag", "tag": "@link", "text": "extractCredentials", "target": 159 }, { "kind": "text", "text": ")." } ] }, "type": { "type": "reference", "target": 59, "name": "Credentials", "package": "@supabase/server" } }, { "id": 165, "name": "options", "variant": "param", "kind": 32768, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Allowed auth modes and optional env overrides." } ] }, "type": { "type": "reference", "target": 172, "name": "VerifyCredentialsOptions", "package": "@supabase/server" } } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Promise" }, "typeArguments": [ { "type": "union", "types": [ { "type": "reflection", "declaration": { "id": 166, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 167, "name": "data", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/verify-credentials.ts", "line": 315, "character": 4, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-credentials.ts#L315" } ], "type": { "type": "reference", "target": 42, "name": "AuthResult", "package": "@supabase/server" } }, { "id": 168, "name": "error", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/verify-credentials.ts", "line": 315, "character": 22, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-credentials.ts#L315" } ], "type": { "type": "literal", "value": null } } ], "groups": [ { "title": "Properties", "children": [ 167, 168 ] } ] } }, { "type": "reflection", "declaration": { "id": 169, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 170, "name": "data", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/verify-credentials.ts", "line": 315, "character": 40, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-credentials.ts#L315" } ], "type": { "type": "literal", "value": null } }, { "id": 171, "name": "error", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "core/verify-credentials.ts", "line": 315, "character": 52, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/verify-credentials.ts#L315" } ], "type": { "type": "reference", "target": 101, "name": "AuthError", "package": "@supabase/server" } } ], "groups": [ { "title": "Properties", "children": [ 170, 171 ] } ] } } ] } ], "name": "Promise", "package": "typescript" } } ] } ], "groups": [ { "title": "Interfaces", "children": [ 186, 172 ], "categories": [ { "title": "Primitives", "children": [ 186, 172 ] } ] }, { "title": "Functions", "children": [ 194, 190, 159, 150, 176, 162 ], "categories": [ { "title": "Primitives", "children": [ 194, 190, 159, 150, 176, 162 ] } ] }, { "title": "References", "children": [ 198, 199, 200 ] } ], "sources": [ { "fileName": "core/index.ts", "line": 1, "character": 0, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/core/index.ts#L1" } ] }, { "id": 10, "name": "index", "variant": "declaration", "kind": 2, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Server-side Supabase utilities for modern runtimes.\n\n" }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": " gives you batteries-included auth and client creation for\nEdge Functions, Workers, and any server runtime that speaks standard " }, { "kind": "code", "text": "`fetch`" }, { "kind": "text", "text": ".\nOne import, one line of config — auth is verified, Supabase clients are ready,\nCORS is handled. Your handler only runs on successful auth.\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase({ auth: 'user' }, async (_req, ctx) => {\n const { data: myGames } = await ctx.supabase.from('favorite_games').select()\n return Response.json(myGames)\n }),\n}\n```" }, { "kind": "text", "text": "\n\n## Auth modes\n\n| Mode | Credential | Use case |\n|------|-----------|----------|\n| " }, { "kind": "code", "text": "`\"user\"`" }, { "kind": "text", "text": " | Valid JWT | Authenticated user endpoints |\n| " }, { "kind": "code", "text": "`\"publishable\"`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " publishable key | Client-facing, key-validated endpoints |\n| " }, { "kind": "code", "text": "`\"secret\"`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " secret key | Server-to-server, internal calls |\n| " }, { "kind": "code", "text": "`\"none\"`" }, { "kind": "text", "text": " | None | Open endpoints |\n\nBare " }, { "kind": "code", "text": "`\"publishable\"`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`\"secret\"`" }, { "kind": "text", "text": " match only the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key; use\n" }, { "kind": "code", "text": "`\"secret:\"`" }, { "kind": "text", "text": " for a specific key or " }, { "kind": "code", "text": "`\"secret:*\"`" }, { "kind": "text", "text": " to accept any key.\n\nArray syntax tries modes in order — first match wins:\n" }, { "kind": "code", "text": "```ts\nwithSupabase({ auth: ['user', 'secret'] }, handler)\n```" }, { "kind": "text", "text": "\n\n## Framework adapters\n\nAdapters for Hono, H3 / Nuxt, Elysia, and NestJS ship inside this package:\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server/adapters/hono'\nimport { withSupabase } from '@supabase/server/adapters/h3'\nimport { withSupabase } from '@supabase/server/adapters/elysia'\nimport { withSupabase, SupabaseCtx } from '@supabase/server/adapters/nestjs'\n```" }, { "kind": "text", "text": "\n\n## Composable primitives\n\nFor custom flows, all lower-level functions are available from " }, { "kind": "code", "text": "`@supabase/server/core`" }, { "kind": "text", "text": ":\n\n" }, { "kind": "code", "text": "```ts\nimport { verifyAuth, createContextClient, createAdminClient } from '@supabase/server/core'\n```" }, { "kind": "text", "text": "\n\n## Installation\n\n" }, { "kind": "code", "text": "```sh\nnpm install @supabase/server\n# or\ndeno add jsr:@supabase/server\n```" } ] }, "children": [ { "id": 27, "name": "createSupabaseContext", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "create-supabase-context.ts", "line": 34, "character": 22, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/create-supabase-context.ts#L34" } ], "signatures": [ { "id": 28, "name": "createSupabaseContext", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Creates a " }, { "kind": "inline-tag", "tag": "@link", "text": "SupabaseContext", "target": 74 }, { "kind": "text", "text": " directly from a request.\n\nUse this when you need the context without the full " }, { "kind": "inline-tag", "tag": "@link", "text": "withSupabase", "target": 15 }, { "kind": "text", "text": " wrapper —\ne.g., inside framework route handlers or custom middleware. Returns a result tuple\ninstead of producing a " }, { "kind": "code", "text": "`Response`" }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@returns", "content": [ { "kind": "code", "text": "`{ data: SupabaseContext, error: null }`" }, { "kind": "text", "text": " on success, " }, { "kind": "code", "text": "`{ data: null, error: AuthError }`" }, { "kind": "text", "text": " on failure." } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Middleware" } ] }, { "tag": "@example", "name": "User auth", "content": [ { "kind": "code", "text": "```ts\nconst { data: ctx, error } = await createSupabaseContext(request, { auth: 'user' })\nif (error) {\n return Response.json({ message: error.message }, { status: error.status })\n}\nconst { data } = await ctx.supabase.rpc('get_my_items')\n```" } ] } ] }, "sources": [ { "fileName": "create-supabase-context.ts", "line": 34, "character": 22, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/create-supabase-context.ts#L34" } ], "typeParameters": [ { "id": 29, "name": "Database", "variant": "typeParam", "kind": 131072, "flags": {}, "default": { "type": "intrinsic", "name": "unknown" } } ], "parameters": [ { "id": 30, "name": "request", "variant": "param", "kind": 32768, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "The incoming HTTP request." } ] }, "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.dom.d.ts", "qualifiedName": "Request" }, "name": "Request", "package": "typescript" } }, { "id": 31, "name": "options", "variant": "param", "kind": 32768, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Auth modes, environment overrides. The " }, { "kind": "code", "text": "`cors`" }, { "kind": "text", "text": " option is ignored here." } ] }, "type": { "type": "reference", "target": 93, "name": "WithSupabaseConfig", "package": "@supabase/server" } } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Promise" }, "typeArguments": [ { "type": "union", "types": [ { "type": "reflection", "declaration": { "id": 32, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 33, "name": "data", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "create-supabase-context.ts", "line": 38, "character": 6, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/create-supabase-context.ts#L38" } ], "type": { "type": "reference", "target": 74, "typeArguments": [ { "type": "reference", "target": 29, "name": "Database", "package": "@supabase/server", "refersToTypeParameter": true } ], "name": "SupabaseContext", "package": "@supabase/server" } }, { "id": 34, "name": "error", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "create-supabase-context.ts", "line": 38, "character": 39, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/create-supabase-context.ts#L38" } ], "type": { "type": "literal", "value": null } } ], "groups": [ { "title": "Properties", "children": [ 33, 34 ] } ] } }, { "type": "reflection", "declaration": { "id": 35, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 36, "name": "data", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "create-supabase-context.ts", "line": 39, "character": 6, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/create-supabase-context.ts#L39" } ], "type": { "type": "literal", "value": null } }, { "id": 37, "name": "error", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "create-supabase-context.ts", "line": 39, "character": 18, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/create-supabase-context.ts#L39" } ], "type": { "type": "reference", "target": 101, "name": "AuthError", "package": "@supabase/server" } } ], "groups": [ { "title": "Properties", "children": [ 36, 37 ] } ] } } ] } ], "name": "Promise", "package": "typescript" } } ] }, { "id": 111, "name": "EnvError", "variant": "declaration", "kind": 128, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Thrown when a required environment variable is missing or malformed.\n\nAlways has " }, { "kind": "code", "text": "`status: 500`" }, { "kind": "text", "text": " — environment errors are server-side configuration issues." } ], "blockTags": [ { "tag": "@example", "name": "Catching an EnvError", "content": [ { "kind": "code", "text": "```ts\nimport { EnvError } from '@supabase/server'\n\ntry {\n const client = createAdminClient()\n} catch (e) {\n if (e instanceof EnvError) {\n console.error(`Config issue [${e.code}]: ${e.message}`)\n // → \"Config issue [MISSING_SUPABASE_URL]: SUPABASE_URL is required but not set\"\n }\n}\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "children": [ { "id": 116, "name": "status", "variant": "declaration", "kind": 1024, "flags": { "isReadonly": true }, "comment": { "summary": [ { "kind": "text", "text": "Always " }, { "kind": "code", "text": "`500`" }, { "kind": "text", "text": " — environment errors are server-side issues." } ] }, "sources": [ { "fileName": "errors.ts", "line": 24, "character": 11, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L24" } ], "type": { "type": "literal", "value": 500 }, "defaultValue": "500" }, { "id": 117, "name": "code", "variant": "declaration", "kind": 1024, "flags": { "isReadonly": true }, "comment": { "summary": [ { "kind": "text", "text": "Machine-readable error code." } ], "blockTags": [ { "tag": "@see", "content": [ { "kind": "inline-tag", "tag": "@link", "text": "EnvGenericError", "target": 118 }, { "kind": "text", "text": ", " }, { "kind": "inline-tag", "tag": "@link", "text": "MissingSupabaseURLError", "target": 149 }, { "kind": "text", "text": ",\n " }, { "kind": "inline-tag", "tag": "@link", "text": "MissingPublishableKeyError", "target": 147 }, { "kind": "text", "text": ", " }, { "kind": "inline-tag", "tag": "@link", "text": "MissingDefaultPublishableKeyError", "target": 145 }, { "kind": "text", "text": ",\n " }, { "kind": "inline-tag", "tag": "@link", "text": "MissingSecretKeyError", "target": 148 }, { "kind": "text", "text": ", " }, { "kind": "inline-tag", "tag": "@link", "text": "MissingDefaultSecretKeyError", "target": 146 } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 33, "character": 11, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L33" } ], "type": { "type": "intrinsic", "name": "string" } }, { "id": 112, "name": "constructor", "variant": "declaration", "kind": 512, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 35, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L35" } ], "signatures": [ { "id": 113, "name": "EnvError", "variant": "signature", "kind": 16384, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 35, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L35" } ], "parameters": [ { "id": 114, "name": "message", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "intrinsic", "name": "string" } }, { "id": 115, "name": "code", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "intrinsic", "name": "string" }, "defaultValue": "EnvGenericError" } ], "type": { "type": "reference", "target": 111, "name": "EnvError", "package": "@supabase/server" }, "overwrites": { "type": "reference", "target": -1, "name": "Error.constructor", "package": "typescript" } } ], "overwrites": { "type": "reference", "target": -1, "name": "Error.constructor", "package": "typescript" } } ], "groups": [ { "title": "Constructors", "children": [ 112 ] }, { "title": "Properties", "children": [ 116, 117 ] } ], "sources": [ { "fileName": "errors.ts", "line": 22, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L22" } ], "extendedTypes": [ { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Error" }, "name": "Error", "package": "typescript" } ] }, { "id": 118, "name": "EnvGenericError", "variant": "declaration", "kind": 32, "flags": { "isConst": true }, "comment": { "summary": [ { "kind": "text", "text": "Generic environment error code." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 46, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L46" } ], "type": { "type": "literal", "value": "ENV_ERROR" }, "defaultValue": "'ENV_ERROR'" }, { "id": 149, "name": "MissingSupabaseURLError", "variant": "declaration", "kind": 32, "flags": { "isConst": true }, "comment": { "summary": [ { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " is not set." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 52, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L52" } ], "type": { "type": "literal", "value": "MISSING_SUPABASE_URL" }, "defaultValue": "'MISSING_SUPABASE_URL'" }, { "id": 147, "name": "MissingPublishableKeyError", "variant": "declaration", "kind": 32, "flags": { "isConst": true }, "comment": { "summary": [ { "kind": "text", "text": "Named publishable key not found in " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 58, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L58" } ], "type": { "type": "literal", "value": "MISSING_PUBLISHABLE_KEY" }, "defaultValue": "'MISSING_PUBLISHABLE_KEY'" }, { "id": 145, "name": "MissingDefaultPublishableKeyError", "variant": "declaration", "kind": 32, "flags": { "isConst": true }, "comment": { "summary": [ { "kind": "text", "text": "No default publishable key found." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 64, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L64" } ], "type": { "type": "literal", "value": "MISSING_DEFAULT_PUBLISHABLE_KEY" }, "defaultValue": "'MISSING_DEFAULT_PUBLISHABLE_KEY'" }, { "id": 148, "name": "MissingSecretKeyError", "variant": "declaration", "kind": 32, "flags": { "isConst": true }, "comment": { "summary": [ { "kind": "text", "text": "Named secret key not found in " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 71, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L71" } ], "type": { "type": "literal", "value": "MISSING_SECRET_KEY" }, "defaultValue": "'MISSING_SECRET_KEY'" }, { "id": 146, "name": "MissingDefaultSecretKeyError", "variant": "declaration", "kind": 32, "flags": { "isConst": true }, "comment": { "summary": [ { "kind": "text", "text": "No default secret key found." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 77, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L77" } ], "type": { "type": "literal", "value": "MISSING_DEFAULT_SECRET_KEY" }, "defaultValue": "'MISSING_DEFAULT_SECRET_KEY'" }, { "id": 101, "name": "AuthError", "variant": "declaration", "kind": 128, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Thrown when authentication or authorization fails.\n\nCarries an HTTP " }, { "kind": "code", "text": "`status`" }, { "kind": "text", "text": " code suitable for returning directly in a response\n(typically " }, { "kind": "code", "text": "`401`" }, { "kind": "text", "text": " for invalid credentials, " }, { "kind": "code", "text": "`500`" }, { "kind": "text", "text": " for server-side auth failures)." } ], "blockTags": [ { "tag": "@example", "name": "Catching an AuthError", "content": [ { "kind": "code", "text": "```ts\nimport { AuthError, createSupabaseContext } from '@supabase/server'\n\nconst { data: ctx, error } = await createSupabaseContext(request, { auth: 'user' })\nif (error) {\n // error is an AuthError\n return Response.json(\n { message: error.message, code: error.code },\n { status: error.status },\n )\n}\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "children": [ { "id": 107, "name": "status", "variant": "declaration", "kind": 1024, "flags": { "isReadonly": true }, "comment": { "summary": [ { "kind": "text", "text": "HTTP status code.\n\n- " }, { "kind": "code", "text": "`401`" }, { "kind": "text", "text": " — Invalid or missing credentials\n- " }, { "kind": "code", "text": "`500`" }, { "kind": "text", "text": " — Server-side auth failure (e.g., missing JWKS, env misconfiguration)" } ] }, "sources": [ { "fileName": "errors.ts", "line": 137, "character": 11, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L137" } ], "type": { "type": "intrinsic", "name": "number" } }, { "id": 108, "name": "code", "variant": "declaration", "kind": 1024, "flags": { "isReadonly": true }, "comment": { "summary": [ { "kind": "text", "text": "Machine-readable error code." } ], "blockTags": [ { "tag": "@see", "content": [ { "kind": "inline-tag", "tag": "@link", "text": "AuthGenericError", "target": 109 }, { "kind": "text", "text": ", " }, { "kind": "inline-tag", "tag": "@link", "text": "InvalidCredentialsError", "target": 144 }, { "kind": "text", "text": ",\n " }, { "kind": "inline-tag", "tag": "@link", "text": "CreateSupabaseClientError", "target": 110 } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 145, "character": 11, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L145" } ], "type": { "type": "intrinsic", "name": "string" } }, { "id": 102, "name": "constructor", "variant": "declaration", "kind": 512, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 147, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L147" } ], "signatures": [ { "id": 103, "name": "AuthError", "variant": "signature", "kind": 16384, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 147, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L147" } ], "parameters": [ { "id": 104, "name": "message", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "intrinsic", "name": "string" } }, { "id": 105, "name": "code", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "intrinsic", "name": "string" }, "defaultValue": "AuthGenericError" }, { "id": 106, "name": "status", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "intrinsic", "name": "number" }, "defaultValue": "401" } ], "type": { "type": "reference", "target": 101, "name": "AuthError", "package": "@supabase/server" }, "overwrites": { "type": "reference", "target": -1, "name": "Error.constructor", "package": "typescript" } } ], "overwrites": { "type": "reference", "target": -1, "name": "Error.constructor", "package": "typescript" } } ], "groups": [ { "title": "Constructors", "children": [ 102 ] }, { "title": "Properties", "children": [ 107, 108 ] } ], "sources": [ { "fileName": "errors.ts", "line": 130, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L130" } ], "extendedTypes": [ { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Error" }, "name": "Error", "package": "typescript" } ] }, { "id": 109, "name": "AuthGenericError", "variant": "declaration", "kind": 32, "flags": { "isConst": true }, "comment": { "summary": [ { "kind": "text", "text": "Generic authentication error code." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 159, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L159" } ], "type": { "type": "literal", "value": "AUTH_ERROR" }, "defaultValue": "'AUTH_ERROR'" }, { "id": 144, "name": "InvalidCredentialsError", "variant": "declaration", "kind": 32, "flags": { "isConst": true }, "comment": { "summary": [ { "kind": "text", "text": "No credential matched any allowed auth mode." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 165, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L165" } ], "type": { "type": "literal", "value": "INVALID_CREDENTIALS" }, "defaultValue": "'INVALID_CREDENTIALS'" }, { "id": 110, "name": "CreateSupabaseClientError", "variant": "declaration", "kind": 32, "flags": { "isConst": true }, "comment": { "summary": [ { "kind": "text", "text": "Failed to create a Supabase client after auth succeeded." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 171, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L171" } ], "type": { "type": "literal", "value": "CREATE_SUPABASE_CLIENT_ERROR" }, "defaultValue": "'CREATE_SUPABASE_CLIENT_ERROR'" }, { "id": 119, "name": "Errors", "variant": "declaration", "kind": 32, "flags": { "isConst": true }, "comment": { "summary": [ { "kind": "text", "text": "Factory map for all error types. Keyed by error code constant, each entry\nreturns a pre-configured " }, { "kind": "inline-tag", "tag": "@link", "text": "EnvError", "target": 111 }, { "kind": "text", "text": " or " }, { "kind": "inline-tag", "tag": "@link", "text": "AuthError", "target": 101 }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@example", "name": "Throwing typed errors", "content": [ { "kind": "code", "text": "```ts\nthrow Errors[MissingSupabaseURLError]()\nthrow Errors[MissingPublishableKeyError]('mobile')\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Errors" } ] } ] }, "sources": [ { "fileName": "errors.ts", "line": 196, "character": 13, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L196" } ], "type": { "type": "reflection", "declaration": { "id": 120, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 127, "name": "MISSING_SUPABASE_URL", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 80, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L80" } ], "type": { "type": "reflection", "declaration": { "id": 128, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "signatures": [ { "id": 129, "name": "__type", "variant": "signature", "kind": 4096, "flags": {}, "type": { "type": "reference", "target": 111, "name": "EnvError", "package": "@supabase/server" } } ] } }, "defaultValue": "..." }, { "id": 130, "name": "MISSING_SECRET_KEY", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 85, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L85" } ], "type": { "type": "reflection", "declaration": { "id": 131, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "signatures": [ { "id": 132, "name": "__type", "variant": "signature", "kind": 4096, "flags": {}, "parameters": [ { "id": 133, "name": "name", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "intrinsic", "name": "string" } } ], "type": { "type": "reference", "target": 111, "name": "EnvError", "package": "@supabase/server" } } ] } }, "defaultValue": "..." }, { "id": 134, "name": "MISSING_DEFAULT_SECRET_KEY", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 90, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L90" } ], "type": { "type": "reflection", "declaration": { "id": 135, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "signatures": [ { "id": 136, "name": "__type", "variant": "signature", "kind": 4096, "flags": {}, "type": { "type": "reference", "target": 111, "name": "EnvError", "package": "@supabase/server" } } ] } }, "defaultValue": "..." }, { "id": 137, "name": "MISSING_PUBLISHABLE_KEY", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 96, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L96" } ], "type": { "type": "reflection", "declaration": { "id": 138, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "signatures": [ { "id": 139, "name": "__type", "variant": "signature", "kind": 4096, "flags": {}, "parameters": [ { "id": 140, "name": "name", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "intrinsic", "name": "string" } } ], "type": { "type": "reference", "target": 111, "name": "EnvError", "package": "@supabase/server" } } ] } }, "defaultValue": "..." }, { "id": 141, "name": "MISSING_DEFAULT_PUBLISHABLE_KEY", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 101, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L101" } ], "type": { "type": "reflection", "declaration": { "id": 142, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "signatures": [ { "id": 143, "name": "__type", "variant": "signature", "kind": 4096, "flags": {}, "type": { "type": "reference", "target": 111, "name": "EnvError", "package": "@supabase/server" } } ] } }, "defaultValue": "..." }, { "id": 121, "name": "INVALID_CREDENTIALS", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 174, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L174" } ], "type": { "type": "reflection", "declaration": { "id": 122, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "signatures": [ { "id": 123, "name": "__type", "variant": "signature", "kind": 4096, "flags": {}, "type": { "type": "reference", "target": 101, "name": "AuthError", "package": "@supabase/server" } } ] } }, "defaultValue": "..." }, { "id": 124, "name": "CREATE_SUPABASE_CLIENT_ERROR", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "errors.ts", "line": 176, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/errors.ts#L176" } ], "type": { "type": "reflection", "declaration": { "id": 125, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "signatures": [ { "id": 126, "name": "__type", "variant": "signature", "kind": 4096, "flags": {}, "type": { "type": "reference", "target": 101, "name": "AuthError", "package": "@supabase/server" } } ] } }, "defaultValue": "..." } ], "groups": [ { "title": "Properties", "children": [ 127, 130, 134, 137, 141, 121, 124 ] } ] } }, "defaultValue": "..." }, { "id": 40, "name": "AuthMode", "variant": "declaration", "kind": 2097152, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Authentication mode that determines what credentials a request must provide.\n\n- " }, { "kind": "code", "text": "`\"none\"`" }, { "kind": "text", "text": " — No credentials required. Every request is accepted.\n- " }, { "kind": "code", "text": "`\"publishable\"`" }, { "kind": "text", "text": " — Requires a valid publishable key in the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header. Matches only the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key.\n- " }, { "kind": "code", "text": "`\"secret\"`" }, { "kind": "text", "text": " — Requires a valid secret key in the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header (timing-safe comparison). Matches only the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key.\n- " }, { "kind": "code", "text": "`\"user\"`" }, { "kind": "text", "text": " — Requires a valid JWT in the " }, { "kind": "code", "text": "`Authorization: Bearer `" }, { "kind": "text", "text": " header.\n\nBare " }, { "kind": "code", "text": "`\"publishable\"`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`\"secret\"`" }, { "kind": "text", "text": " resolve the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key from\n" }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": ". To target another key or\naccept any key, see " }, { "kind": "inline-tag", "tag": "@link", "text": "AuthModeWithKey", "target": 41 }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@example", "name": "Single mode", "content": [ { "kind": "code", "text": "```ts\n// Single mode\nwithSupabase({ auth: 'user' }, handler)\n\n// Multiple modes — the first match wins.\n// A mode is tried only when its credential is present; a JWT that is\n// present but fails verification rejects immediately rather than falling\n// through to the next mode.\nwithSupabase({ auth: ['user', 'publishable'] }, handler)\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "sources": [ { "fileName": "types.ts", "line": 36, "character": 12, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L36" } ], "type": { "type": "union", "types": [ { "type": "literal", "value": "none" }, { "type": "literal", "value": "publishable" }, { "type": "literal", "value": "secret" }, { "type": "literal", "value": "user" } ] } }, { "id": 38, "name": "Allow", "variant": "declaration", "kind": 2097152, "flags": {}, "comment": { "summary": [], "blockTags": [ { "tag": "@deprecated", "content": [ { "kind": "text", "text": "Use " }, { "kind": "inline-tag", "tag": "@link", "text": "AuthMode", "target": 40 }, { "kind": "text", "text": " instead. Will be removed in a future major release." } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "sources": [ { "fileName": "types.ts", "line": 42, "character": 12, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L42" } ], "type": { "type": "reference", "target": 40, "name": "AuthMode", "package": "@supabase/server" } }, { "id": 41, "name": "AuthModeWithKey", "variant": "declaration", "kind": 2097152, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Extended auth mode that supports targeting a specific named key.\n\nUse the colon syntax (" }, { "kind": "code", "text": "`\"publishable:web_app\"`" }, { "kind": "text", "text": ") to require a specific named key\nfrom the " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": " JSON object.\nUse " }, { "kind": "code", "text": "`\"publishable:*\"`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`\"secret:*\"`" }, { "kind": "text", "text": " to accept any key in the set. The bare\nform without a colon (" }, { "kind": "code", "text": "`\"publishable\"`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`\"secret\"`" }, { "kind": "text", "text": ") matches only the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key." } ], "blockTags": [ { "tag": "@example", "name": "Named key", "content": [ { "kind": "code", "text": "```ts\n// Accept only the \"mobile\" publishable key\nwithSupabase({ auth: 'publishable:mobile' }, handler)\n\n// Accept any secret key\nwithSupabase({ auth: 'secret:*' }, handler)\n\n// Mix named keys with other modes\nwithSupabase({ auth: ['user', 'publishable:web_app'] }, handler)\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "sources": [ { "fileName": "types.ts", "line": 66, "character": 12, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L66" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 40, "name": "AuthMode", "package": "@supabase/server" }, { "type": "templateLiteral", "head": "publishable:", "tail": [ [ { "type": "intrinsic", "name": "string" }, "" ] ] }, { "type": "templateLiteral", "head": "secret:", "tail": [ [ { "type": "intrinsic", "name": "string" }, "" ] ] } ] } }, { "id": 39, "name": "AllowWithKey", "variant": "declaration", "kind": 2097152, "flags": {}, "comment": { "summary": [], "blockTags": [ { "tag": "@deprecated", "content": [ { "kind": "text", "text": "Use " }, { "kind": "inline-tag", "tag": "@link", "text": "AuthModeWithKey", "target": 41 }, { "kind": "text", "text": " instead. Will be removed in a future major release." } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "sources": [ { "fileName": "types.ts", "line": 75, "character": 12, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L75" } ], "type": { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" } }, { "id": 82, "name": "SupabaseEnv", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Resolved Supabase environment configuration.\n\nHolds the project URL, API keys, and JWKS needed by every other primitive.\nTypically resolved automatically from environment variables by " }, { "kind": "inline-tag", "tag": "@link", "text": "core.resolveEnv", "target": 150 }, { "kind": "text", "text": ",\nbut can be passed explicitly via the " }, { "kind": "code", "text": "`env`" }, { "kind": "text", "text": " option." } ], "blockTags": [ { "tag": "@see", "content": [ { "kind": "inline-tag", "tag": "@link", "text": "core.resolveEnv", "target": 150 }, { "kind": "text", "text": " for how each field maps to environment variables." } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "children": [ { "id": 83, "name": "url", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Supabase project URL (e.g. " }, { "kind": "code", "text": "`\"https://.supabase.co\"`" }, { "kind": "text", "text": "). Sourced from " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": "." } ] }, "sources": [ { "fileName": "types.ts", "line": 89, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L89" } ], "type": { "type": "intrinsic", "name": "string" } }, { "id": 84, "name": "publishableKeys", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Named publishable keys. Sourced from " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " (JSON object)\nor " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEY`" }, { "kind": "text", "text": " (single key, stored as " }, { "kind": "code", "text": "`{ default: \"\" }`" }, { "kind": "text", "text": ")." } ] }, "sources": [ { "fileName": "types.ts", "line": 95, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L95" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Record" }, "typeArguments": [ { "type": "intrinsic", "name": "string" }, { "type": "intrinsic", "name": "string" } ], "name": "Record", "package": "typescript" } }, { "id": 85, "name": "secretKeys", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Named secret keys. Sourced from " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": " (JSON object)\nor " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEY`" }, { "kind": "text", "text": " (single key, stored as " }, { "kind": "code", "text": "`{ default: \"\" }`" }, { "kind": "text", "text": ")." } ] }, "sources": [ { "fileName": "types.ts", "line": 101, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L101" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Record" }, "typeArguments": [ { "type": "intrinsic", "name": "string" }, { "type": "intrinsic", "name": "string" } ], "name": "Record", "package": "typescript" } }, { "id": 86, "name": "jwks", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "JWKS source used for JWT verification.\n\nSourced from one of (in priority order):\n- " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " — inline JSON. Resolves to a " }, { "kind": "code", "text": "`JSONWebKeySet`" }, { "kind": "text", "text": ".\n- " }, { "kind": "code", "text": "`SUPABASE_JWKS_URL`" }, { "kind": "text", "text": " — remote endpoint. Resolves to a " }, { "kind": "code", "text": "`URL`" }, { "kind": "text", "text": "; keys\n are fetched lazily and cached in memory (cooldown / max-age handled by\n " }, { "kind": "code", "text": "`jose`" }, { "kind": "text", "text": "). " }, { "kind": "code", "text": "`https://`" }, { "kind": "text", "text": " is always accepted; plain " }, { "kind": "code", "text": "`http://`" }, { "kind": "text", "text": " is accepted\n only for loopback hosts (" }, { "kind": "code", "text": "`localhost`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`127.0.0.0/8`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`::1`" }, { "kind": "text", "text": ") to support\n the Supabase CLI. Any other " }, { "kind": "code", "text": "`http://`" }, { "kind": "text", "text": " URL is rejected to prevent MITM\n swap-in of a forged signing key.\n\n" }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " when no JWKS is configured (JWT verification will be unavailable).\nEach env var is authoritative when set: a malformed value resolves to\n" }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " rather than falling through to the other variable." } ] }, "sources": [ { "fileName": "types.ts", "line": 119, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L119" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": { "packageName": "jose", "packagePath": "dist/types/types.d.ts", "qualifiedName": "JSONWebKeySet" }, "name": "JSONWebKeySet", "package": "jose" }, { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.dom.d.ts", "qualifiedName": "URL" }, "name": "URL", "package": "typescript" }, { "type": "literal", "value": null } ] } } ], "groups": [ { "title": "Properties", "children": [ 83, 84, 85, 86 ] } ], "sources": [ { "fileName": "types.ts", "line": 87, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L87" } ] }, { "id": 59, "name": "Credentials", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Raw credentials extracted from an incoming HTTP request.\n\nProduced by " }, { "kind": "inline-tag", "tag": "@link", "text": "core.extractCredentials", "target": 159 }, { "kind": "text", "text": " from the " }, { "kind": "code", "text": "`Authorization`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " headers." } ], "blockTags": [ { "tag": "@see", "content": [ { "kind": "inline-tag", "tag": "@link", "text": "core.extractCredentials", "target": 159 } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "children": [ { "id": 60, "name": "token", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Bearer token from the " }, { "kind": "code", "text": "`Authorization: Bearer `" }, { "kind": "text", "text": " header, or " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " if absent." } ] }, "sources": [ { "fileName": "types.ts", "line": 132, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L132" } ], "type": { "type": "union", "types": [ { "type": "intrinsic", "name": "string" }, { "type": "literal", "value": null } ] } }, { "id": 61, "name": "apikey", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "API key from the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header, or " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " if absent." } ] }, "sources": [ { "fileName": "types.ts", "line": 135, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L135" } ], "type": { "type": "union", "types": [ { "type": "intrinsic", "name": "string" }, { "type": "literal", "value": null } ] } } ], "groups": [ { "title": "Properties", "children": [ 60, 61 ] } ], "sources": [ { "fileName": "types.ts", "line": 130, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L130" } ] }, { "id": 42, "name": "AuthResult", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Result of credential verification.\n\nContains the resolved auth mode, the verified token (for " }, { "kind": "code", "text": "`\"user\"`" }, { "kind": "text", "text": " mode),\ndecoded JWT claims, and the matched key name (for " }, { "kind": "code", "text": "`\"publishable\"`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`\"secret\"`" }, { "kind": "text", "text": " modes)." } ], "blockTags": [ { "tag": "@see", "content": [ { "kind": "text", "text": " - " }, { "kind": "inline-tag", "tag": "@link", "text": "core.verifyCredentials", "target": 162 }, { "kind": "text", "text": "\n" }, { "kind": "text", "text": " - " }, { "kind": "inline-tag", "tag": "@link", "text": "core.verifyAuth", "target": 176 }, { "kind": "text", "text": "\n" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "children": [ { "id": 43, "name": "authMode", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "The auth mode that was successfully matched." } ] }, "sources": [ { "fileName": "types.ts", "line": 150, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L150" } ], "type": { "type": "reference", "target": 40, "name": "AuthMode", "package": "@supabase/server" } }, { "id": 44, "name": "token", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "The verified JWT, or " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " for non-user auth modes." } ] }, "sources": [ { "fileName": "types.ts", "line": 153, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L153" } ], "type": { "type": "union", "types": [ { "type": "intrinsic", "name": "string" }, { "type": "literal", "value": null } ] } }, { "id": 45, "name": "userClaims", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Normalized user identity derived from the JWT, or " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " when no JWT is present." } ] }, "sources": [ { "fileName": "types.ts", "line": 156, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L156" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 87, "name": "UserClaims", "package": "@supabase/server" }, { "type": "literal", "value": null } ] } }, { "id": 46, "name": "jwtClaims", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Raw JWT payload, or " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " when no JWT is present." } ] }, "sources": [ { "fileName": "types.ts", "line": 159, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L159" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 62, "name": "JWTClaims", "package": "@supabase/server" }, { "type": "literal", "value": null } ] } }, { "id": 47, "name": "keyName", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Name of the matched key (e.g. " }, { "kind": "code", "text": "`\"default\"`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`\"mobile\"`" }, { "kind": "text", "text": "), or " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " for " }, { "kind": "code", "text": "`\"user\"`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`\"none\"`" }, { "kind": "text", "text": " modes." } ] }, "sources": [ { "fileName": "types.ts", "line": 162, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L162" } ], "type": { "type": "union", "types": [ { "type": "intrinsic", "name": "string" }, { "type": "literal", "value": null } ] } } ], "groups": [ { "title": "Properties", "children": [ 43, 44, 45, 46, 47 ] } ], "sources": [ { "fileName": "types.ts", "line": 148, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L148" } ] }, { "id": 62, "name": "JWTClaims", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Standard JWT claims as defined by RFC 7519, extended with Supabase-specific fields.\n\nThis is the raw JWT payload — use " }, { "kind": "inline-tag", "tag": "@link", "text": "UserClaims", "target": 87 }, { "kind": "text", "text": " for a normalized, camelCase view." } ], "blockTags": [ { "tag": "@see", "content": [ { "kind": "text", "text": "https://datatracker.ietf.org/doc/html/rfc7519#section-4.1" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "children": [ { "id": 63, "name": "sub", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Subject — the user's unique ID." } ] }, "sources": [ { "fileName": "types.ts", "line": 175, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L175" } ], "type": { "type": "intrinsic", "name": "string" } }, { "id": 64, "name": "iss", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Issuer — typically your Supabase project URL." } ] }, "sources": [ { "fileName": "types.ts", "line": 178, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L178" } ], "type": { "type": "intrinsic", "name": "string" } }, { "id": 65, "name": "aud", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Audience — who the token is intended for." } ] }, "sources": [ { "fileName": "types.ts", "line": 181, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L181" } ], "type": { "type": "union", "types": [ { "type": "intrinsic", "name": "string" }, { "type": "array", "elementType": { "type": "intrinsic", "name": "string" } } ] } }, { "id": 66, "name": "exp", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Expiration time (seconds since epoch)." } ] }, "sources": [ { "fileName": "types.ts", "line": 184, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L184" } ], "type": { "type": "intrinsic", "name": "number" } }, { "id": 67, "name": "iat", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Issued at (seconds since epoch)." } ] }, "sources": [ { "fileName": "types.ts", "line": 187, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L187" } ], "type": { "type": "intrinsic", "name": "number" } }, { "id": 68, "name": "role", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Supabase role (e.g. " }, { "kind": "code", "text": "`\"authenticated\"`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`\"anon\"`" }, { "kind": "text", "text": ")." } ] }, "sources": [ { "fileName": "types.ts", "line": 190, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L190" } ], "type": { "type": "intrinsic", "name": "string" } }, { "id": 69, "name": "email", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "User's email address from Supabase Auth." } ] }, "sources": [ { "fileName": "types.ts", "line": 193, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L193" } ], "type": { "type": "intrinsic", "name": "string" } }, { "id": 70, "name": "app_metadata", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Application-level metadata set via Supabase Auth admin APIs." } ] }, "sources": [ { "fileName": "types.ts", "line": 196, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L196" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Record" }, "typeArguments": [ { "type": "intrinsic", "name": "string" }, { "type": "intrinsic", "name": "unknown" } ], "name": "Record", "package": "typescript" } }, { "id": 71, "name": "user_metadata", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "User-editable metadata set via Supabase Auth." } ] }, "sources": [ { "fileName": "types.ts", "line": 199, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L199" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Record" }, "typeArguments": [ { "type": "intrinsic", "name": "string" }, { "type": "intrinsic", "name": "unknown" } ], "name": "Record", "package": "typescript" } } ], "groups": [ { "title": "Properties", "children": [ 63, 64, 65, 66, 67, 68, 69, 70, 71 ] } ], "sources": [ { "fileName": "types.ts", "line": 173, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L173" } ], "indexSignatures": [ { "id": 72, "name": "__index", "variant": "signature", "kind": 8192, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Additional custom claims." } ] }, "sources": [ { "fileName": "types.ts", "line": 202, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L202" } ], "parameters": [ { "id": 73, "name": "key", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "intrinsic", "name": "string" } } ], "type": { "type": "intrinsic", "name": "unknown" } } ] }, { "id": 87, "name": "UserClaims", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Normalized, camelCase view of the authenticated user's identity.\n\nDerived from " }, { "kind": "inline-tag", "tag": "@link", "text": "JWTClaims", "target": 62 }, { "kind": "text", "text": ". For the full Supabase " }, { "kind": "code", "text": "`User`" }, { "kind": "text", "text": " object\n(including email confirmation status, providers, etc.), call\n" }, { "kind": "code", "text": "`supabase.auth.getUser()`" }, { "kind": "text", "text": " using the context client." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "children": [ { "id": 88, "name": "id", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "User's unique ID (same as " }, { "kind": "code", "text": "`JWTClaims.sub`" }, { "kind": "text", "text": ")." } ] }, "sources": [ { "fileName": "types.ts", "line": 215, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L215" } ], "type": { "type": "intrinsic", "name": "string" } }, { "id": 89, "name": "role", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Supabase role (e.g. " }, { "kind": "code", "text": "`\"authenticated\"`" }, { "kind": "text", "text": ")." } ] }, "sources": [ { "fileName": "types.ts", "line": 218, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L218" } ], "type": { "type": "intrinsic", "name": "string" } }, { "id": 90, "name": "email", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "User's email address." } ] }, "sources": [ { "fileName": "types.ts", "line": 221, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L221" } ], "type": { "type": "intrinsic", "name": "string" } }, { "id": 91, "name": "appMetadata", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Application-level metadata (e.g. roles, permissions)." } ] }, "sources": [ { "fileName": "types.ts", "line": 224, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L224" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Record" }, "typeArguments": [ { "type": "intrinsic", "name": "string" }, { "type": "intrinsic", "name": "unknown" } ], "name": "Record", "package": "typescript" } }, { "id": 92, "name": "userMetadata", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "User-editable profile metadata (e.g. display name, avatar)." } ] }, "sources": [ { "fileName": "types.ts", "line": 227, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L227" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Record" }, "typeArguments": [ { "type": "intrinsic", "name": "string" }, { "type": "intrinsic", "name": "unknown" } ], "name": "Record", "package": "typescript" } } ], "groups": [ { "title": "Properties", "children": [ 88, 89, 90, 91, 92 ] } ], "sources": [ { "fileName": "types.ts", "line": 213, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L213" } ] }, { "id": 93, "name": "WithSupabaseConfig", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Configuration for " }, { "kind": "inline-tag", "tag": "@link", "text": "withSupabase", "target": 15 }, { "kind": "text", "text": " and " }, { "kind": "inline-tag", "tag": "@link", "text": "createSupabaseContext", "target": 27 }, { "kind": "text", "text": ".\n\nControls which auth modes are accepted, environment overrides, and CORS behavior." } ], "blockTags": [ { "tag": "@example", "name": "Basic usage", "content": [ { "kind": "code", "text": "```ts\n// Require authenticated users, auto-CORS enabled (default)\nconst config: WithSupabaseConfig = { auth: 'user' }\n\n// Accept users or service-to-service calls, custom CORS headers\nconst config: WithSupabaseConfig = {\n auth: ['user', 'secret'],\n cors: { 'Access-Control-Allow-Origin': 'https://myapp.com' },\n}\n\n// No auth required, CORS disabled\nconst config: WithSupabaseConfig = { auth: 'none', cors: 'disabled' }\n```" } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "children": [ { "id": 94, "name": "auth", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Auth mode(s) to accept. Modes are tried in order — the first match wins.\nA mode falls through only when its credential is absent; a present-but-invalid\nJWT short-circuits the chain with " }, { "kind": "code", "text": "`InvalidCredentialsError`" }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@defaultValue", "content": [ { "kind": "code", "text": "`\"user\"`" } ] } ] }, "sources": [ { "fileName": "types.ts", "line": 260, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L260" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" }, { "type": "array", "elementType": { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" } } ] } }, { "id": 95, "name": "allow", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [], "blockTags": [ { "tag": "@deprecated", "content": [ { "kind": "text", "text": "Use " }, { "kind": "inline-tag", "tag": "@link", "text": "WithSupabaseConfig.auth", "target": 94 }, { "kind": "text", "text": " instead. The " }, { "kind": "code", "text": "`allow`" }, { "kind": "text", "text": " option\nis kept for backward compatibility and will be removed in a future major release.\nWhen both " }, { "kind": "code", "text": "`auth`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`allow`" }, { "kind": "text", "text": " are provided, " }, { "kind": "code", "text": "`auth`" }, { "kind": "text", "text": " takes precedence." } ] } ] }, "sources": [ { "fileName": "types.ts", "line": 267, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L267" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" }, { "type": "array", "elementType": { "type": "reference", "target": 41, "name": "AuthModeWithKey", "package": "@supabase/server" } } ] } }, { "id": 96, "name": "env", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Override auto-detected environment variables. Useful for testing\nor when running in environments without standard env var support." } ] }, "sources": [ { "fileName": "types.ts", "line": 273, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L273" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Partial" }, "typeArguments": [ { "type": "reference", "target": 82, "name": "SupabaseEnv", "package": "@supabase/server" } ], "name": "Partial", "package": "typescript" } }, { "id": 97, "name": "cors", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "CORS configuration for the " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " wrapper.\n\n- " }, { "kind": "code", "text": "`'default'`" }, { "kind": "text", "text": " — uses " }, { "kind": "code", "text": "`@supabase/supabase-js`" }, { "kind": "text", "text": " default CORS headers.\n- " }, { "kind": "code", "text": "`'disabled'`" }, { "kind": "text", "text": " — disables CORS handling entirely.\n- " }, { "kind": "code", "text": "`{ headers }`" }, { "kind": "text", "text": " — custom CORS headers.\n\nThe boolean (" }, { "kind": "code", "text": "`true`" }, { "kind": "text", "text": "/" }, { "kind": "code", "text": "`false`" }, { "kind": "text", "text": ") and bare " }, { "kind": "code", "text": "`Record`" }, { "kind": "text", "text": " forms are\ndeprecated but still accepted for backward compatibility." } ], "blockTags": [ { "tag": "@remarks", "content": [ { "kind": "text", "text": "Only applies to the top-level " }, { "kind": "inline-tag", "tag": "@link", "text": "withSupabase", "target": 15 }, { "kind": "text", "text": " wrapper.\nThe adapters (Hono, H3, Elysia, NestJS) handle CORS separately via each\nframework's own middleware." } ] }, { "tag": "@defaultValue", "content": [ { "kind": "code", "text": "`'default'`" } ] } ] }, "sources": [ { "fileName": "types.ts", "line": 291, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L291" } ], "type": { "type": "union", "types": [ { "type": "intrinsic", "name": "boolean" }, { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Record" }, "typeArguments": [ { "type": "intrinsic", "name": "string" }, { "type": "intrinsic", "name": "string" } ], "name": "Record", "package": "typescript" }, { "type": "literal", "value": "default" }, { "type": "literal", "value": "disabled" }, { "type": "reflection", "declaration": { "id": 98, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "children": [ { "id": 99, "name": "headers", "variant": "declaration", "kind": 1024, "flags": {}, "sources": [ { "fileName": "types.ts", "line": 294, "character": 8, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L294" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Record" }, "typeArguments": [ { "type": "intrinsic", "name": "string" }, { "type": "intrinsic", "name": "string" } ], "name": "Record", "package": "typescript" } } ], "groups": [ { "title": "Properties", "children": [ 99 ] } ] } } ] } }, { "id": 100, "name": "supabaseOptions", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Options forwarded to both internal " }, { "kind": "code", "text": "`createClient()`" }, { "kind": "text", "text": " calls.\n\n" }, { "kind": "code", "text": "`accessToken`" }, { "kind": "text", "text": " is stripped, and auth settings (" }, { "kind": "code", "text": "`persistSession`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`autoRefreshToken`" }, { "kind": "text", "text": ",\n" }, { "kind": "code", "text": "`detectSessionInUrl`" }, { "kind": "text", "text": ") are force-overwritten to server-safe values." } ], "blockTags": [ { "tag": "@example", "name": "Custom Supabase options", "content": [ { "kind": "code", "text": "```ts\nwithSupabase({\n auth: 'user',\n supabaseOptions: { db: { schema: 'api' } },\n}, handler)\n```" } ] } ] }, "sources": [ { "fileName": "types.ts", "line": 314, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L314" } ], "type": { "type": "reference", "target": { "packageName": "@supabase/supabase-js", "packagePath": "src/lib/rest/types/common/common.ts", "qualifiedName": "SupabaseClientOptions" }, "typeArguments": [ { "type": "intrinsic", "name": "string" } ], "name": "SupabaseClientOptions", "package": "@supabase/supabase-js" } } ], "groups": [ { "title": "Properties", "children": [ 94, 95, 96, 97, 100 ] } ], "sources": [ { "fileName": "types.ts", "line": 252, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L252" } ] }, { "id": 48, "name": "ClientAuth", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Auth identity for client creation functions." } ], "blockTags": [ { "tag": "@see", "content": [ { "kind": "inline-tag", "tag": "@link", "text": "core.verifyAuth", "target": 176 }, { "kind": "text", "text": ", " }, { "kind": "inline-tag", "tag": "@link", "text": "core.verifyCredentials", "target": 162 } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "children": [ { "id": 49, "name": "token", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "The caller's JWT, or " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " for anonymous access." } ] }, "sources": [ { "fileName": "types.ts", "line": 325, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L325" } ], "type": { "type": "union", "types": [ { "type": "intrinsic", "name": "string" }, { "type": "literal", "value": null } ] } }, { "id": 50, "name": "keyName", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Name of the API key to use. Falls back to " }, { "kind": "code", "text": "`\"default\"`" }, { "kind": "text", "text": ", then first available." } ] }, "sources": [ { "fileName": "types.ts", "line": 328, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L328" } ], "type": { "type": "union", "types": [ { "type": "intrinsic", "name": "string" }, { "type": "literal", "value": null } ] } } ], "groups": [ { "title": "Properties", "children": [ 49, 50 ] } ], "sources": [ { "fileName": "types.ts", "line": 323, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L323" } ] }, { "id": 55, "name": "CreateContextClientOptions", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Options for " }, { "kind": "inline-tag", "tag": "@link", "text": "core.createContextClient", "target": 190 }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "children": [ { "id": 56, "name": "auth", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Auth identity — token and key name from the verified request." } ] }, "sources": [ { "fileName": "types.ts", "line": 337, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L337" } ], "type": { "type": "reference", "target": 48, "name": "ClientAuth", "package": "@supabase/server" } }, { "id": 57, "name": "env", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Override auto-detected environment variables." } ] }, "sources": [ { "fileName": "types.ts", "line": 340, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L340" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Partial" }, "typeArguments": [ { "type": "reference", "target": 82, "name": "SupabaseEnv", "package": "@supabase/server" } ], "name": "Partial", "package": "typescript" } }, { "id": 58, "name": "supabaseOptions", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Options forwarded to " }, { "kind": "code", "text": "`createClient()`" }, { "kind": "text", "text": ". " }, { "kind": "code", "text": "`accessToken`" }, { "kind": "text", "text": " is stripped; auth settings are force-overwritten." } ] }, "sources": [ { "fileName": "types.ts", "line": 343, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L343" } ], "type": { "type": "reference", "target": { "packageName": "@supabase/supabase-js", "packagePath": "src/lib/rest/types/common/common.ts", "qualifiedName": "SupabaseClientOptions" }, "typeArguments": [ { "type": "intrinsic", "name": "string" } ], "name": "SupabaseClientOptions", "package": "@supabase/supabase-js" } } ], "groups": [ { "title": "Properties", "children": [ 56, 57, 58 ] } ], "sources": [ { "fileName": "types.ts", "line": 335, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L335" } ] }, { "id": 51, "name": "CreateAdminClientOptions", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Options for " }, { "kind": "inline-tag", "tag": "@link", "text": "core.createAdminClient", "target": 194 }, { "kind": "text", "text": "." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "children": [ { "id": 52, "name": "auth", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Auth identity — key name from the verified request." } ] }, "sources": [ { "fileName": "types.ts", "line": 352, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L352" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Pick" }, "typeArguments": [ { "type": "reference", "target": 48, "name": "ClientAuth", "package": "@supabase/server" }, { "type": "literal", "value": "keyName" } ], "name": "Pick", "package": "typescript" } }, { "id": 53, "name": "env", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Override auto-detected environment variables." } ] }, "sources": [ { "fileName": "types.ts", "line": 355, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L355" } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Partial" }, "typeArguments": [ { "type": "reference", "target": 82, "name": "SupabaseEnv", "package": "@supabase/server" } ], "name": "Partial", "package": "typescript" } }, { "id": 54, "name": "supabaseOptions", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "Options forwarded to " }, { "kind": "code", "text": "`createClient()`" }, { "kind": "text", "text": ". " }, { "kind": "code", "text": "`accessToken`" }, { "kind": "text", "text": " is stripped; auth settings are force-overwritten." } ] }, "sources": [ { "fileName": "types.ts", "line": 358, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L358" } ], "type": { "type": "reference", "target": { "packageName": "@supabase/supabase-js", "packagePath": "src/lib/rest/types/common/common.ts", "qualifiedName": "SupabaseClientOptions" }, "typeArguments": [ { "type": "intrinsic", "name": "string" } ], "name": "SupabaseClientOptions", "package": "@supabase/supabase-js" } } ], "groups": [ { "title": "Properties", "children": [ 52, 53, 54 ] } ], "sources": [ { "fileName": "types.ts", "line": 350, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L350" } ] }, { "id": 74, "name": "SupabaseContext", "variant": "declaration", "kind": 256, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "The Supabase context created for each authenticated request.\n\nContains pre-configured Supabase clients and the caller's identity.\nIdentical regardless of which layer or adapter produced it." } ], "blockTags": [ { "tag": "@category", "content": [ { "kind": "text", "text": "Types" } ] } ] }, "children": [ { "id": 76, "name": "supabase", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Supabase client scoped to the caller's identity. RLS policies apply." } ] }, "sources": [ { "fileName": "types.ts", "line": 370, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L370" } ], "type": { "type": "reference", "target": { "packageName": "@supabase/supabase-js", "packagePath": "src/lib/rest/types/common/common.ts", "qualifiedName": "SupabaseClient" }, "typeArguments": [ { "type": "reference", "target": 75, "name": "Database", "package": "@supabase/server", "qualifiedName": "SupabaseContext.Database", "refersToTypeParameter": true } ], "name": "SupabaseClient", "package": "@supabase/supabase-js" } }, { "id": 77, "name": "supabaseAdmin", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Admin Supabase client that bypasses Row-Level Security." } ] }, "sources": [ { "fileName": "types.ts", "line": 373, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L373" } ], "type": { "type": "reference", "target": { "packageName": "@supabase/supabase-js", "packagePath": "src/lib/rest/types/common/common.ts", "qualifiedName": "SupabaseClient" }, "typeArguments": [ { "type": "reference", "target": 75, "name": "Database", "package": "@supabase/server", "qualifiedName": "SupabaseContext.Database", "refersToTypeParameter": true } ], "name": "SupabaseClient", "package": "@supabase/supabase-js" } }, { "id": 78, "name": "userClaims", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "JWT-derived identity. For the full Supabase User object, call " }, { "kind": "code", "text": "`supabase.auth.getUser()`" }, { "kind": "text", "text": "." } ] }, "sources": [ { "fileName": "types.ts", "line": 376, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L376" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 87, "name": "UserClaims", "package": "@supabase/server" }, { "type": "literal", "value": null } ] } }, { "id": 79, "name": "jwtClaims", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Raw JWT payload. " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " for non-user auth modes." } ] }, "sources": [ { "fileName": "types.ts", "line": 379, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L379" } ], "type": { "type": "union", "types": [ { "type": "reference", "target": 62, "name": "JWTClaims", "package": "@supabase/server" }, { "type": "literal", "value": null } ] } }, { "id": 80, "name": "authMode", "variant": "declaration", "kind": 1024, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "The auth mode that was used for this request." } ] }, "sources": [ { "fileName": "types.ts", "line": 382, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L382" } ], "type": { "type": "reference", "target": 40, "name": "AuthMode", "package": "@supabase/server" } }, { "id": 81, "name": "authKeyName", "variant": "declaration", "kind": 1024, "flags": { "isOptional": true }, "comment": { "summary": [ { "kind": "text", "text": "The auth key name of the API key that was used for this request.\nOmitted for " }, { "kind": "code", "text": "`'user'`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`'none'`" }, { "kind": "text", "text": " modes, which don't match a named key." } ] }, "sources": [ { "fileName": "types.ts", "line": 388, "character": 2, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L388" } ], "type": { "type": "intrinsic", "name": "string" } } ], "groups": [ { "title": "Properties", "children": [ 76, 77, 78, 79, 80, 81 ] } ], "sources": [ { "fileName": "types.ts", "line": 368, "character": 17, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/types.ts#L368" } ], "typeParameters": [ { "id": 75, "name": "Database", "variant": "typeParam", "kind": 131072, "flags": {}, "default": { "type": "intrinsic", "name": "unknown" } } ] }, { "id": 15, "name": "withSupabase", "variant": "declaration", "kind": 64, "flags": {}, "sources": [ { "fileName": "with-supabase.ts", "line": 30, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/with-supabase.ts#L30" } ], "signatures": [ { "id": 16, "name": "withSupabase", "variant": "signature", "kind": 4096, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Wraps a request handler with Supabase auth, client creation, and CORS handling.\n\nBuilt for the Web API " }, { "kind": "code", "text": "`Request`" }, { "kind": "text", "text": "/" }, { "kind": "code", "text": "`Response`" }, { "kind": "text", "text": " standard that all modern runtimes\nimplement natively. Handles CORS preflight, credential verification,\ncontext creation, and error responses. Your handler only runs on successful auth." } ], "blockTags": [ { "tag": "@returns", "content": [ { "kind": "text", "text": "A " }, { "kind": "code", "text": "`(req: Request) => Promise`" }, { "kind": "text", "text": " fetch handler." } ] }, { "tag": "@category", "content": [ { "kind": "text", "text": "Middleware" } ] }, { "tag": "@example", "name": "Basic usage", "content": [ { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase({ auth: 'user' }, async (req, ctx) => {\n const { data } = await ctx.supabase.rpc('get_my_profile')\n return Response.json(data)\n }),\n}\n```" } ] } ] }, "sources": [ { "fileName": "with-supabase.ts", "line": 30, "character": 16, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/with-supabase.ts#L30" } ], "typeParameters": [ { "id": 17, "name": "Database", "variant": "typeParam", "kind": 131072, "flags": {}, "default": { "type": "intrinsic", "name": "unknown" } } ], "parameters": [ { "id": 18, "name": "config", "variant": "param", "kind": 32768, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Auth modes, CORS, and environment overrides. See " }, { "kind": "inline-tag", "tag": "@link", "text": "WithSupabaseConfig", "target": 93 }, { "kind": "text", "text": "." } ] }, "type": { "type": "reference", "target": 93, "name": "WithSupabaseConfig", "package": "@supabase/server" } }, { "id": 19, "name": "handler", "variant": "param", "kind": 32768, "flags": {}, "comment": { "summary": [ { "kind": "text", "text": "Receives the " }, { "kind": "code", "text": "`Request`" }, { "kind": "text", "text": " and a fully-initialized " }, { "kind": "inline-tag", "tag": "@link", "text": "SupabaseContext", "target": 74 }, { "kind": "text", "text": "." } ] }, "type": { "type": "reflection", "declaration": { "id": 20, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "signatures": [ { "id": 21, "name": "__type", "variant": "signature", "kind": 4096, "flags": {}, "parameters": [ { "id": 22, "name": "req", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.dom.d.ts", "qualifiedName": "Request" }, "name": "Request", "package": "typescript" } }, { "id": 23, "name": "ctx", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "reference", "target": 74, "typeArguments": [ { "type": "reference", "target": 17, "name": "Database", "package": "@supabase/server", "refersToTypeParameter": true } ], "name": "SupabaseContext", "package": "@supabase/server" } } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Promise" }, "typeArguments": [ { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.dom.d.ts", "qualifiedName": "Response" }, "name": "Response", "package": "typescript" } ], "name": "Promise", "package": "typescript" } } ] } } } ], "type": { "type": "reflection", "declaration": { "id": 24, "name": "__type", "variant": "declaration", "kind": 65536, "flags": {}, "signatures": [ { "id": 25, "name": "__type", "variant": "signature", "kind": 4096, "flags": {}, "parameters": [ { "id": 26, "name": "req", "variant": "param", "kind": 32768, "flags": {}, "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.dom.d.ts", "qualifiedName": "Request" }, "name": "Request", "package": "typescript" } } ], "type": { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.es5.d.ts", "qualifiedName": "Promise" }, "typeArguments": [ { "type": "reference", "target": { "packageName": "typescript", "packagePath": "lib/lib.dom.d.ts", "qualifiedName": "Response" }, "name": "Response", "package": "typescript" } ], "name": "Promise", "package": "typescript" } } ] } } } ] } ], "groups": [ { "title": "Classes", "children": [ 111, 101 ], "categories": [ { "title": "Errors", "children": [ 111, 101 ] } ] }, { "title": "Interfaces", "children": [ 82, 59, 42, 62, 87, 93, 48, 55, 51, 74 ], "categories": [ { "title": "Types", "children": [ 82, 59, 42, 62, 87, 93, 48, 55, 51, 74 ] } ] }, { "title": "Type Aliases", "children": [ 40, 38, 41, 39 ], "categories": [ { "title": "Types", "children": [ 40, 38, 41, 39 ] } ] }, { "title": "Variables", "children": [ 118, 149, 147, 145, 148, 146, 109, 144, 110, 119 ], "categories": [ { "title": "Errors", "children": [ 118, 149, 147, 145, 148, 146, 109, 144, 110, 119 ] } ] }, { "title": "Functions", "children": [ 27, 15 ], "categories": [ { "title": "Middleware", "children": [ 27, 15 ] } ] } ], "sources": [ { "fileName": "index.ts", "line": 1, "character": 0, "url": "https://github.com/supabase/server/blob/54f869ea3d36bc576bb46ba40bfcb4f448a6d122/src/index.ts#L1" } ] } ], "documents": [ { "id": 1, "name": "getting-started", "variant": "document", "kind": 8388608, "flags": {}, "content": [ { "kind": "text", "text": "# Getting Started\n\n## Installation\n\n" }, { "kind": "code", "text": "```bash\n# Deno (import directly)\nimport { withSupabase } from 'npm:@supabase/server'\n\n# npm\nnpm install @supabase/server\n\n# pnpm\npnpm add @supabase/server\n\n```" }, { "kind": "text", "text": "\n\n" }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": " requires " }, { "kind": "code", "text": "`@supabase/supabase-js`" }, { "kind": "text", "text": " as a peer dependency:\n\n" }, { "kind": "code", "text": "```bash\n# npm\nnpm install @supabase/supabase-js\n\n# pnpm\npnpm add @supabase/supabase-js\n```" }, { "kind": "text", "text": "\n\n## Your first authenticated endpoint\n\nThe fastest way to get a working authenticated endpoint:\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase({ auth: 'user' }, async (_req, ctx) => {\n const { data } = await ctx.supabase.from('todos').select()\n return Response.json(data)\n }),\n}\n```" }, { "kind": "text", "text": "\n\n> The " }, { "kind": "code", "text": "`export default { fetch }`" }, { "kind": "text", "text": " pattern is the standard module worker interface supported by Deno (including Supabase Edge Functions), Bun, and Cloudflare Workers. For Node.js, use the [Hono adapter](" }, { "kind": "relative-link", "text": "adapters/hono.md", "target": 1 }, { "kind": "text", "text": ") or [core primitives](" }, { "kind": "relative-link", "text": "core-primitives.md", "target": 2 }, { "kind": "text", "text": ") with your framework of choice.\n\nThis single wrapper does four things for every request:\n\n1. **CORS** — handles " }, { "kind": "code", "text": "`OPTIONS`" }, { "kind": "text", "text": " preflight and adds CORS headers to all responses\n2. **Auth** — extracts and verifies credentials from request headers\n3. **Clients** — creates two Supabase clients: one scoped to the caller, one admin\n4. **Errors** — returns a JSON error response (" }, { "kind": "code", "text": "`{ message, code }`" }, { "kind": "text", "text": ") if auth fails\n\nYour handler only runs when auth succeeds.\n\n## A public endpoint (no auth)\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase({ auth: 'none' }, async (_req, _ctx) => {\n return Response.json({ status: 'ok', time: new Date().toISOString() })\n }),\n}\n```" }, { "kind": "text", "text": "\n\n> **Supabase Edge Functions:** By default, the platform requires a valid JWT on every request. If your function uses " }, { "kind": "code", "text": "`auth: 'publishable'`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`auth: 'secret'`" }, { "kind": "text", "text": ", or " }, { "kind": "code", "text": "`auth: 'none'`" }, { "kind": "text", "text": ", disable the platform-level JWT check in " }, { "kind": "code", "text": "`supabase/config.toml`" }, { "kind": "text", "text": ":\n>\n> " }, { "kind": "code", "text": "```toml\n> [functions.my-function]\n> verify_jwt = false\n> ```" }, { "kind": "text", "text": "\n\n## What's in the context\n\nEvery handler receives a " }, { "kind": "code", "text": "`SupabaseContext`" }, { "kind": "text", "text": " with these fields:\n\n| Field | Type | Description |\n| --------------- | --------------------- | ------------------------------------------------------------------------------------------------------ |\n| " }, { "kind": "code", "text": "`supabase`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`SupabaseClient`" }, { "kind": "text", "text": " | Client scoped to the caller. RLS policies apply. |\n| " }, { "kind": "code", "text": "`supabaseAdmin`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`SupabaseClient`" }, { "kind": "text", "text": " | Admin client. Bypasses RLS. |\n| " }, { "kind": "code", "text": "`userClaims`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`UserClaims \\| null`" }, { "kind": "text", "text": " | JWT-derived identity (" }, { "kind": "code", "text": "`id`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`email`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`role`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`appMetadata`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`userMetadata`" }, { "kind": "text", "text": "). " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " for non-user auth. |\n| " }, { "kind": "code", "text": "`jwtClaims`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`JWTClaims \\| null`" }, { "kind": "text", "text": " | Raw JWT payload (snake_case). " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " for non-user auth. |\n| " }, { "kind": "code", "text": "`authMode`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`AuthMode`" }, { "kind": "text", "text": " | Which auth mode matched: " }, { "kind": "code", "text": "`'user'`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`'publishable'`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`'secret'`" }, { "kind": "text", "text": ", or " }, { "kind": "code", "text": "`'none'`" }, { "kind": "text", "text": ". |\n| " }, { "kind": "code", "text": "`authKeyName`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`string \\| undefined`" }, { "kind": "text", "text": " | Which auth key name of the API key that was used. Omitted for " }, { "kind": "code", "text": "`'user'`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`'none'`" }, { "kind": "text", "text": ". |\n\nThe " }, { "kind": "code", "text": "`supabase`" }, { "kind": "text", "text": " client respects Row-Level Security. When " }, { "kind": "code", "text": "`authMode`" }, { "kind": "text", "text": " is " }, { "kind": "code", "text": "`'user'`" }, { "kind": "text", "text": ", the client is scoped to that user's permissions. For other auth modes, it's initialized as anonymous.\n\nThe " }, { "kind": "code", "text": "`supabaseAdmin`" }, { "kind": "text", "text": " client always bypasses RLS. Use it for operations that need full database access regardless of who's calling.\n\n" }, { "kind": "code", "text": "`userClaims`" }, { "kind": "text", "text": " gives you a lightweight view of the user's identity from the JWT. For the full Supabase " }, { "kind": "code", "text": "`User`" }, { "kind": "text", "text": " object (email confirmation, providers, etc.), call " }, { "kind": "code", "text": "`ctx.supabase.auth.getUser()`" }, { "kind": "text", "text": ".\n\n## Using createSupabaseContext directly\n\nWhen you need the context without the full wrapper — inside a framework route handler, custom middleware, or any situation where you want to control the response yourself:\n\n" }, { "kind": "code", "text": "```ts\nimport { createSupabaseContext } from '@supabase/server'\n\nexport default {\n fetch: async (req: Request) => {\n const { data: ctx, error } = await createSupabaseContext(req, {\n auth: 'user',\n })\n\n if (error) {\n return Response.json(\n { message: error.message, code: error.code },\n { status: error.status },\n )\n }\n\n const { data } = await ctx!.supabase.from('todos').select()\n return Response.json(data)\n },\n}\n```" }, { "kind": "text", "text": "\n\n" }, { "kind": "code", "text": "`createSupabaseContext`" }, { "kind": "text", "text": " returns a result tuple " }, { "kind": "code", "text": "`{ data, error }`" }, { "kind": "text", "text": " instead of producing a Response. This gives you full control over error formatting and response headers.\n\n## CORS configuration\n\nCORS is enabled by default with standard supabase-js headers. You can customize or disable it:\n\n" }, { "kind": "code", "text": "```ts\n// Custom CORS headers\nwithSupabase(\n {\n auth: 'user',\n cors: {\n headers: {\n 'Access-Control-Allow-Origin': 'https://myapp.com',\n 'Access-Control-Allow-Headers': 'authorization, content-type',\n },\n },\n },\n handler,\n)\n\n// Disable CORS (e.g., when a framework handles it)\nwithSupabase({ auth: 'user', cors: 'disabled' }, handler)\n```" }, { "kind": "text", "text": "\n\n" }, { "kind": "code", "text": "`cors`" }, { "kind": "text", "text": " accepts " }, { "kind": "code", "text": "`'default'`" }, { "kind": "text", "text": " (standard supabase-js headers), " }, { "kind": "code", "text": "`'disabled'`" }, { "kind": "text", "text": ", or\n" }, { "kind": "code", "text": "`{ headers }`" }, { "kind": "text", "text": " for custom headers. The boolean (" }, { "kind": "code", "text": "`true`" }, { "kind": "text", "text": "/" }, { "kind": "code", "text": "`false`" }, { "kind": "text", "text": ") and bare\n" }, { "kind": "code", "text": "`Record`" }, { "kind": "text", "text": " forms are deprecated but still accepted.\n\n## Runtimes\n\n" }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`createSupabaseContext`" }, { "kind": "text", "text": " work with any runtime that supports the Web API " }, { "kind": "code", "text": "`Request`" }, { "kind": "text", "text": "/" }, { "kind": "code", "text": "`Response`" }, { "kind": "text", "text": " standard. The [core primitives](" }, { "kind": "relative-link", "text": "core-primitives.md", "target": 2 }, { "kind": "text", "text": ") go further — they work in any environment where you can extract headers, regardless of the request/response model (Express, Fastify, etc.).\n\n- **Supabase Edge Functions** — environment variables are automatically injected by the platform. Zero config needed.\n- **Deno / Bun** — works out of the box with the module worker pattern.\n- **Node.js** — set variables via " }, { "kind": "code", "text": "`.env`" }, { "kind": "text", "text": " files or your hosting platform. Use the [Hono adapter](" }, { "kind": "relative-link", "text": "adapters/hono.md", "target": 1 }, { "kind": "text", "text": ") or [core primitives](" }, { "kind": "relative-link", "text": "core-primitives.md", "target": 2 }, { "kind": "text", "text": ") to integrate with any framework.\n- **Cloudflare Workers** — enable " }, { "kind": "code", "text": "`nodejs_compat`" }, { "kind": "text", "text": " or pass env overrides via the " }, { "kind": "code", "text": "`env`" }, { "kind": "text", "text": " config option.\n\nFor full details on environment setup per runtime, see [environment-variables.md](" }, { "kind": "relative-link", "text": "environment-variables.md", "target": 3 }, { "kind": "text", "text": ")." } ], "frontmatter": {} }, { "id": 2, "name": "core-primitives", "variant": "document", "kind": 8388608, "flags": {}, "content": [ { "kind": "text", "text": "# Core Primitives\n\n## When to use primitives\n\nUse " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`createSupabaseContext`" }, { "kind": "text", "text": " for standard use cases. Drop down to core primitives when you need:\n\n- Multiple routes with different auth in a single handler\n- Custom response headers or error formats\n- Integration with frameworks other than the ones provided\n- Pre-extracted credentials (e.g., from cookies, custom headers)\n- Just auth verification without client creation\n\nAll primitives are available from " }, { "kind": "code", "text": "`@supabase/server/core`" }, { "kind": "text", "text": ".\n\n## The composition pipeline\n\nThe primitives compose into a pipeline. Each step is independent — use only what you need:\n\n" }, { "kind": "code", "text": "```\nresolveEnv() → SupabaseEnv\nextractCredentials(request) → Credentials { token, apikey }\nverifyCredentials(credentials, opts) → AuthResult { authMode, token, userClaims, jwtClaims, keyName }\ncreateContextClient(options) → SupabaseClient (RLS-scoped)\ncreateAdminClient(options) → SupabaseClient (bypasses RLS)\n```" }, { "kind": "text", "text": "\n\nOr use the convenience function that combines extraction and verification:\n\n" }, { "kind": "code", "text": "```\nverifyAuth(request, opts) → AuthResult (extractCredentials + verifyCredentials in one call)\n```" }, { "kind": "text", "text": "\n\n## resolveEnv\n\nResolves Supabase environment configuration from runtime variables. The only hard requirement is " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": ".\n\n" }, { "kind": "code", "text": "```ts\nimport { resolveEnv } from '@supabase/server/core'\n\nconst { data: env, error } = resolveEnv()\nif (error) {\n // error is an EnvError — e.g., SUPABASE_URL not set\n console.error(error.message)\n}\n```" }, { "kind": "text", "text": "\n\nWith partial overrides:\n\n" }, { "kind": "code", "text": "```ts\nconst { data: envOverridden } = resolveEnv({\n url: 'http://localhost:54321',\n})\n```" }, { "kind": "text", "text": "\n\nReturns " }, { "kind": "code", "text": "`{ data: SupabaseEnv, error: null }`" }, { "kind": "text", "text": " on success, " }, { "kind": "code", "text": "`{ data: null, error: EnvError }`" }, { "kind": "text", "text": " on failure.\n\n## extractCredentials\n\nPure extraction — reads headers, performs no validation.\n\n" }, { "kind": "code", "text": "```ts\nimport { extractCredentials } from '@supabase/server/core'\n\nconst creds = extractCredentials(request)\n// creds.token → string | null (from Authorization: Bearer )\n// creds.apikey → string | null (from apikey header)\n```" }, { "kind": "text", "text": "\n\nThis is synchronous and never fails. Fields are " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " when the corresponding header is absent.\n\n## verifyCredentials\n\nVerifies pre-extracted credentials against allowed auth modes. Use this when credentials come from a non-standard source (cookies, custom headers, etc.).\n\n" }, { "kind": "code", "text": "```ts\nimport { verifyCredentials } from '@supabase/server/core'\n\nconst credentials = { token: cookieToken, apikey: null }\nconst { data: auth, error } = await verifyCredentials(credentials, {\n auth: 'user',\n})\n\nif (error) {\n return Response.json({ message: error.message }, { status: error.status })\n}\n\nconsole.log(auth!.authMode) // 'user'\nconsole.log(auth!.userClaims) // { id: '...', email: '...', role: 'authenticated' }\n```" }, { "kind": "text", "text": "\n\nSupports all auth mode syntax — single mode, arrays, and named keys:\n\n" }, { "kind": "code", "text": "```ts\n// Multiple modes\nconst { data: auth } = await verifyCredentials(creds, {\n auth: ['user', 'publishable'],\n})\n\n// Named key\nconst { data: auth } = await verifyCredentials(creds, {\n auth: 'publishable:web',\n})\n\n// Wildcard\nconst { data: auth } = await verifyCredentials(creds, {\n auth: 'secret:*',\n})\n```" }, { "kind": "text", "text": "\n\n## verifyAuth\n\nConvenience function that combines " }, { "kind": "code", "text": "`extractCredentials`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": " in a single call. Use this when working with a standard " }, { "kind": "code", "text": "`Request`" }, { "kind": "text", "text": ":\n\n" }, { "kind": "code", "text": "```ts\nimport { verifyAuth } from '@supabase/server/core'\n\nconst { data: auth, error } = await verifyAuth(request, {\n auth: 'user',\n})\n\nif (error) {\n return Response.json({ message: error.message }, { status: error.status })\n}\n\nconsole.log(auth.userClaims!.id) // \"d0f1a2b3-...\"\nconsole.log(auth.token) // the verified JWT string\n```" }, { "kind": "text", "text": "\n\n## createContextClient\n\nCreates a Supabase client scoped to the caller's identity. RLS policies apply.\n\n" }, { "kind": "code", "text": "```ts\nimport { verifyAuth, createContextClient } from '@supabase/server/core'\n\n// With a user's token (from verifyAuth)\nconst { data: auth } = await verifyAuth(request, { auth: 'user' })\nconst supabase = createContextClient({\n auth: { token: auth!.token, keyName: auth!.keyName },\n})\n```" }, { "kind": "text", "text": "\n\n" }, { "kind": "code", "text": "```ts\n// Anonymous (no token) — RLS as anon role\nconst anonClient = createContextClient()\n```" }, { "kind": "text", "text": "\n\nThe client is configured with:\n\n- The publishable key as the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header\n- The user's JWT as the " }, { "kind": "code", "text": "`Authorization: Bearer`" }, { "kind": "text", "text": " header (if token is provided)\n- Server-safe auth settings: " }, { "kind": "code", "text": "`persistSession: false`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`autoRefreshToken: false`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`detectSessionInUrl: false`" }, { "kind": "text", "text": "\n\n**Which key is used.** With " }, { "kind": "code", "text": "`auth.keyName`" }, { "kind": "text", "text": " set, that named key from " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " is used (and it throws if the key doesn't exist). With " }, { "kind": "code", "text": "`keyName`" }, { "kind": "text", "text": " omitted, the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key is used, falling back to the first key in the set when no " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " exists. Note this differs from the " }, { "kind": "code", "text": "`'publishable'`" }, { "kind": "text", "text": " auth mode, which matches the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key only and never falls back.\n\nThis function throws " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " if " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " or the required publishable key is missing. Wrap in try/catch when using directly.\n\n## createAdminClient\n\nCreates a Supabase client that bypasses Row-Level Security using a secret key.\n\n" }, { "kind": "code", "text": "```ts\nimport { createAdminClient } from '@supabase/server/core'\n\nconst supabaseAdmin = createAdminClient()\n```" }, { "kind": "text", "text": "\n\n" }, { "kind": "code", "text": "```ts\n// With a specific named key\nconst supabaseAdminInternal = createAdminClient({\n auth: { keyName: 'internal' },\n})\n```" }, { "kind": "text", "text": "\n\n**Which key is used.** With " }, { "kind": "code", "text": "`auth.keyName`" }, { "kind": "text", "text": " set, that named key from " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": " is used (and it throws if the key doesn't exist). With " }, { "kind": "code", "text": "`keyName`" }, { "kind": "text", "text": " omitted, the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key is used, falling back to the first key in the set when no " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " exists. Note this differs from the " }, { "kind": "code", "text": "`'secret'`" }, { "kind": "text", "text": " auth mode, which matches the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key only and never falls back.\n\nSame server-safe settings as " }, { "kind": "code", "text": "`createContextClient`" }, { "kind": "text", "text": ". Throws " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " if the secret key is missing.\n\n## Full example: custom multi-route handler\n\nUsing primitives to build a handler with different auth per route, without a framework:\n\n" }, { "kind": "code", "text": "```ts\nimport {\n verifyAuth,\n createContextClient,\n createAdminClient,\n} from '@supabase/server/core'\n\nexport default {\n fetch: async (req: Request) => {\n const url = new URL(req.url)\n\n // Public route — no auth needed\n if (url.pathname === '/health') {\n return Response.json({ status: 'ok' })\n }\n\n // User-authenticated route\n if (url.pathname === '/todos') {\n const { data: auth, error } = await verifyAuth(req, { auth: 'user' })\n if (error) {\n return Response.json(\n { message: error.message },\n { status: error.status },\n )\n }\n\n const supabase = createContextClient({\n auth: { token: auth!.token, keyName: auth!.keyName },\n })\n const { data } = await supabase.from('todos').select()\n return Response.json(data)\n }\n\n // Admin route — secret key only\n if (url.pathname === '/admin/users') {\n const { data: auth, error } = await verifyAuth(req, {\n auth: 'secret',\n })\n if (error) {\n return Response.json(\n { message: error.message },\n { status: error.status },\n )\n }\n\n const supabaseAdmin = createAdminClient({\n auth: { keyName: auth!.keyName },\n })\n const { data } = await supabaseAdmin.from('profiles').select()\n return Response.json(data)\n }\n\n return new Response('Not found', { status: 404 })\n },\n}\n```" }, { "kind": "text", "text": "\n\n## Cookie-based environments (with " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": ")\n\nIn Next.js, SvelteKit, Remix, and other cookie-based frameworks, the JWT lives in session cookies rather than the " }, { "kind": "code", "text": "`Authorization`" }, { "kind": "text", "text": " header. The recommended pattern is to **compose with [" }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": "](https://github.com/supabase/ssr)**: let " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " own the cookie session lifecycle and refresh-token rotation (via middleware), then hand its fresh access token to " }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": " and build typed clients with " }, { "kind": "code", "text": "`createContextClient`" }, { "kind": "text", "text": " + " }, { "kind": "code", "text": "`createAdminClient`" }, { "kind": "text", "text": ".\n\nFor the full pattern — middleware setup, the composed adapter, JWKS caching, and other-framework adapting tips — see [ssr-frameworks.md](" }, { "kind": "relative-link", "text": "ssr-frameworks.md", "target": 5 }, { "kind": "text", "text": ")." } ], "frontmatter": {} }, { "id": 3, "name": "api-reference", "variant": "document", "kind": 8388608, "flags": {}, "content": [ { "kind": "text", "text": "# API Reference\n\nComplete reference for every export, organized by entry point.\n\n---\n\n## @supabase/server\n\n### withSupabase\n\n" }, { "kind": "code", "text": "```ts\nfunction withSupabase(\n config: WithSupabaseConfig,\n handler: (req: Request, ctx: SupabaseContext) => Promise,\n): (req: Request) => Promise\n```" }, { "kind": "text", "text": "\n\nWraps a fetch handler with auth, CORS, and client creation. Returns a " }, { "kind": "code", "text": "`(req: Request) => Promise`" }, { "kind": "text", "text": " function suitable for " }, { "kind": "code", "text": "`export default { fetch }`" }, { "kind": "text", "text": ".\n\n- Handles " }, { "kind": "code", "text": "`OPTIONS`" }, { "kind": "text", "text": " preflight when CORS is enabled\n- Verifies credentials per " }, { "kind": "code", "text": "`config.auth`" }, { "kind": "text", "text": "\n- Returns JSON error response on auth failure\n- Adds CORS headers to all responses\n\n### createSupabaseContext\n\n" }, { "kind": "code", "text": "```ts\nfunction createSupabaseContext(\n request: Request,\n options?: WithSupabaseConfig,\n): Promise<\n | { data: SupabaseContext; error: null }\n | { data: null; error: AuthError }\n>\n```" }, { "kind": "text", "text": "\n\nCreates a " }, { "kind": "code", "text": "`SupabaseContext`" }, { "kind": "text", "text": " from a request. Returns a result tuple. The " }, { "kind": "code", "text": "`cors`" }, { "kind": "text", "text": " option is ignored.\n\nDefaults to " }, { "kind": "code", "text": "`auth: 'user'`" }, { "kind": "text", "text": " when " }, { "kind": "code", "text": "`options`" }, { "kind": "text", "text": " is omitted.\n\n---\n\n## @supabase/server/core\n\n### verifyAuth\n\n" }, { "kind": "code", "text": "```ts\nfunction verifyAuth(\n request: Request,\n options: {\n auth?: AuthModeWithKey | AuthModeWithKey[]\n env?: Partial\n },\n): Promise<{ data: AuthResult; error: null } | { data: null; error: AuthError }>\n```" }, { "kind": "text", "text": "\n\nExtracts credentials from a request and verifies them. Convenience wrapper over " }, { "kind": "code", "text": "`extractCredentials`" }, { "kind": "text", "text": " + " }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": ".\n\n### verifyCredentials\n\n" }, { "kind": "code", "text": "```ts\nfunction verifyCredentials(\n credentials: Credentials,\n options: {\n auth?: AuthModeWithKey | AuthModeWithKey[]\n env?: Partial\n },\n): Promise<{ data: AuthResult; error: null } | { data: null; error: AuthError }>\n```" }, { "kind": "text", "text": "\n\nVerifies pre-extracted credentials against allowed auth modes. Tries each mode in order — first match wins.\n\n### extractCredentials\n\n" }, { "kind": "code", "text": "```ts\nfunction extractCredentials(request: Request): Credentials\n```" }, { "kind": "text", "text": "\n\nReads " }, { "kind": "code", "text": "`Authorization: Bearer `" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " headers from a request. Pure extraction, no validation. Synchronous.\n\n### resolveEnv\n\n" }, { "kind": "code", "text": "```ts\nfunction resolveEnv(\n overrides?: Partial,\n): { data: SupabaseEnv; error: null } | { data: null; error: EnvError }\n```" }, { "kind": "text", "text": "\n\nResolves Supabase environment configuration from runtime variables. " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " is the only hard requirement.\n\n### createContextClient\n\n" }, { "kind": "code", "text": "```ts\nfunction createContextClient(\n options?: CreateContextClientOptions,\n): SupabaseClient\n```" }, { "kind": "text", "text": "\n\nCreates a user-scoped Supabase client. RLS applies. **Throws " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": "** if URL or publishable key is missing.\n\nConfigured with:\n\n- Publishable key (named or default) as " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header\n- User's JWT as " }, { "kind": "code", "text": "`Authorization: Bearer`" }, { "kind": "text", "text": " header (when " }, { "kind": "code", "text": "`auth.token`" }, { "kind": "text", "text": " is provided)\n- " }, { "kind": "code", "text": "`persistSession: false`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`autoRefreshToken: false`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`detectSessionInUrl: false`" }, { "kind": "text", "text": "\n\n### createAdminClient\n\n" }, { "kind": "code", "text": "```ts\nfunction createAdminClient(\n options?: CreateAdminClientOptions,\n): SupabaseClient\n```" }, { "kind": "text", "text": "\n\nCreates an admin Supabase client that bypasses RLS. **Throws " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": "** if URL or secret key is missing.\n\n---\n\n## @supabase/server/adapters/hono\n\n### withSupabase (Hono)\n\n" }, { "kind": "code", "text": "```ts\nfunction withSupabase(\n config?: Omit,\n): MiddlewareHandler\n```" }, { "kind": "text", "text": "\n\nHono middleware. Sets " }, { "kind": "code", "text": "`c.var.supabaseContext`" }, { "kind": "text", "text": " on the Hono context. Throws " }, { "kind": "code", "text": "`HTTPException`" }, { "kind": "text", "text": " on auth failure with " }, { "kind": "code", "text": "`cause: AuthError`" }, { "kind": "text", "text": ".\n\nSkips if " }, { "kind": "code", "text": "`c.var.supabaseContext`" }, { "kind": "text", "text": " is already set (enables route-level overrides).\n\nDefaults to " }, { "kind": "code", "text": "`auth: 'user'`" }, { "kind": "text", "text": " when config is omitted.\n\n---\n\n## @supabase/server/adapters/h3\n\n### withSupabase (H3)\n\n" }, { "kind": "code", "text": "```ts\nfunction withSupabase(config?: Omit): Middleware\n```" }, { "kind": "text", "text": "\n\nH3 middleware. Sets " }, { "kind": "code", "text": "`event.context.supabaseContext`" }, { "kind": "text", "text": " on the H3 event. Throws " }, { "kind": "code", "text": "`HTTPError`" }, { "kind": "text", "text": " on auth failure with " }, { "kind": "code", "text": "`cause: AuthError`" }, { "kind": "text", "text": ".\n\nSkips if " }, { "kind": "code", "text": "`event.context.supabaseContext`" }, { "kind": "text", "text": " is already set (enables chained middleware).\n\nDefaults to " }, { "kind": "code", "text": "`auth: 'user'`" }, { "kind": "text", "text": " when config is omitted.\n\n---\n\n## @supabase/server/adapters/elysia\n\n### withSupabase (Elysia)\n\n" }, { "kind": "code", "text": "```ts\nfunction withSupabase(config?: Omit): Elysia\n```" }, { "kind": "text", "text": "\n\nElysia plugin that resolves " }, { "kind": "code", "text": "`supabaseContext`" }, { "kind": "text", "text": " into the request context. Throws an error on auth failure with " }, { "kind": "code", "text": "`cause: AuthError`" }, { "kind": "text", "text": ".\n\nSkips if " }, { "kind": "code", "text": "`supabaseContext`" }, { "kind": "text", "text": " is already resolved by a prior plugin.\n\nDefaults to " }, { "kind": "code", "text": "`auth: 'user'`" }, { "kind": "text", "text": " when config is omitted.\n\n---\n\n## Types\n\n### AuthMode\n\n" }, { "kind": "code", "text": "```ts\ntype AuthMode = 'none' | 'publishable' | 'secret' | 'user'\n```" }, { "kind": "text", "text": "\n\n### AuthModeWithKey\n\n" }, { "kind": "code", "text": "```ts\ntype AuthModeWithKey = AuthMode | `publishable:${string}` | `secret:${string}`\n```" }, { "kind": "text", "text": "\n\nExtended auth mode with named key support. Examples: " }, { "kind": "code", "text": "`'publishable:web'`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`'secret:*'`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`'secret:internal'`" }, { "kind": "text", "text": ". The bare form (" }, { "kind": "code", "text": "`'publishable'`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`'secret'`" }, { "kind": "text", "text": ") matches only the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key; " }, { "kind": "code", "text": "`:*`" }, { "kind": "text", "text": " accepts any key in the set.\n\n### Allow / AllowWithKey (deprecated aliases)\n\n" }, { "kind": "code", "text": "`Allow`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`AllowWithKey`" }, { "kind": "text", "text": " are kept as deprecated aliases for " }, { "kind": "code", "text": "`AuthMode`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`AuthModeWithKey`" }, { "kind": "text", "text": ". Prefer the " }, { "kind": "code", "text": "`Auth*`" }, { "kind": "text", "text": " names — the legacy ones will be removed in a future major release.\n\n### SupabaseContext\\\n\n" }, { "kind": "code", "text": "```ts\ninterface SupabaseContext {\n supabase: SupabaseClient\n supabaseAdmin: SupabaseClient\n userClaims: UserClaims | null\n jwtClaims: JWTClaims | null\n authMode: AuthMode\n authKeyName?: string\n}\n```" }, { "kind": "text", "text": "\n\n### WithSupabaseConfig\n\n" }, { "kind": "code", "text": "```ts\ninterface WithSupabaseConfig {\n auth?: AuthModeWithKey | AuthModeWithKey[] // default: 'user'\n /** @deprecated use `auth` instead — will be removed in a future major release */\n allow?: AuthModeWithKey | AuthModeWithKey[]\n env?: Partial\n cors?: boolean | Record // default: true\n supabaseOptions?: SupabaseClientOptions\n}\n```" }, { "kind": "text", "text": "\n\n### SupabaseEnv\n\n" }, { "kind": "code", "text": "```ts\ninterface SupabaseEnv {\n url: string\n publishableKeys: Record\n secretKeys: Record\n jwks: JsonWebKeySet | null\n}\n```" }, { "kind": "text", "text": "\n\n### Credentials\n\n" }, { "kind": "code", "text": "```ts\ninterface Credentials {\n token: string | null\n apikey: string | null\n}\n```" }, { "kind": "text", "text": "\n\n### AuthResult\n\n" }, { "kind": "code", "text": "```ts\ninterface AuthResult {\n authMode: AuthMode\n token: string | null\n userClaims: UserClaims | null\n jwtClaims: JWTClaims | null\n keyName?: string | null\n}\n```" }, { "kind": "text", "text": "\n\n### JWTClaims\n\n" }, { "kind": "code", "text": "```ts\ninterface JWTClaims {\n sub: string\n iss?: string\n aud?: string | string[]\n exp?: number\n iat?: number\n role?: string\n email?: string\n app_metadata?: Record\n user_metadata?: Record\n [key: string]: unknown\n}\n```" }, { "kind": "text", "text": "\n\n### UserClaims\n\n" }, { "kind": "code", "text": "```ts\ninterface UserClaims {\n id: string\n role?: string\n email?: string\n appMetadata?: Record\n userMetadata?: Record\n}\n```" }, { "kind": "text", "text": "\n\n### ClientAuth\n\n" }, { "kind": "code", "text": "```ts\ninterface ClientAuth {\n token?: string | null\n keyName?: string | null\n}\n```" }, { "kind": "text", "text": "\n\n### CreateContextClientOptions\n\n" }, { "kind": "code", "text": "```ts\ninterface CreateContextClientOptions {\n auth?: ClientAuth\n env?: Partial\n supabaseOptions?: SupabaseClientOptions\n}\n```" }, { "kind": "text", "text": "\n\n### CreateAdminClientOptions\n\n" }, { "kind": "code", "text": "```ts\ninterface CreateAdminClientOptions {\n auth?: Pick\n env?: Partial\n supabaseOptions?: SupabaseClientOptions\n}\n```" }, { "kind": "text", "text": "\n\n### JsonWebKeySet\n\n" }, { "kind": "code", "text": "```ts\ninterface JsonWebKeySet {\n keys: JsonWebKey[]\n}\n```" }, { "kind": "text", "text": "\n\n### Peer Dependencies\n\nSome peer dependencies types are available from " }, { "kind": "code", "text": "`@supabase/server/peer/*`" }, { "kind": "text", "text": " export\n\n#### supabase-js\n\nOnly a curated set of types are available to import — It means that may be missing types from the original lib.\n\n" }, { "kind": "code", "text": "```ts\nimport type {\n SupabaseClient,\n PostgrestError,\n AuthError as SupabaseAuthError, // Avoid clashing with this SDK's own `AuthError` class.\n // ...\n} from '@supabase/server/peer/supabase-js'\n```" }, { "kind": "text", "text": "\n\n---\n\n## Error Classes\n\n### EnvError\n\n" }, { "kind": "code", "text": "```ts\nclass EnvError extends Error {\n readonly status: 500\n readonly code: string\n}\n```" }, { "kind": "text", "text": "\n\n### AuthError\n\n" }, { "kind": "code", "text": "```ts\nclass AuthError extends Error {\n readonly status: number // 401 or 500\n readonly code: string\n}\n```" }, { "kind": "text", "text": "\n\n---\n\n## Error Code Constants\n\n| Constant | Value | Class | Meaning |\n| ----------------------------------- | ----------------------------------- | ----------- | ------------------------------------------------- |\n| " }, { "kind": "code", "text": "`EnvGenericError`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`'ENV_ERROR'`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " | Generic environment error |\n| " }, { "kind": "code", "text": "`MissingSupabaseURLError`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`'MISSING_SUPABASE_URL'`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " not set |\n| " }, { "kind": "code", "text": "`MissingPublishableKeyError`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`'MISSING_PUBLISHABLE_KEY'`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " | Named publishable key not found |\n| " }, { "kind": "code", "text": "`MissingDefaultPublishableKeyError`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`'MISSING_DEFAULT_PUBLISHABLE_KEY'`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " | No default publishable key |\n| " }, { "kind": "code", "text": "`MissingSecretKeyError`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`'MISSING_SECRET_KEY'`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " | Named secret key not found |\n| " }, { "kind": "code", "text": "`MissingDefaultSecretKeyError`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`'MISSING_DEFAULT_SECRET_KEY'`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " | No default secret key |\n| " }, { "kind": "code", "text": "`AuthGenericError`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`'AUTH_ERROR'`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`AuthError`" }, { "kind": "text", "text": " | Generic auth error |\n| " }, { "kind": "code", "text": "`InvalidCredentialsError`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`'INVALID_CREDENTIALS'`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`AuthError`" }, { "kind": "text", "text": " | No credential matched, or JWT failed verification |\n| " }, { "kind": "code", "text": "`CreateSupabaseClientError`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`'CREATE_SUPABASE_CLIENT_ERROR'`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`AuthError`" }, { "kind": "text", "text": " | Client creation failed after auth |\n\n---\n\n## Errors Factory Map\n\n" }, { "kind": "code", "text": "```ts\nconst Errors: {\n [MissingSupabaseURLError]: () => EnvError\n [MissingPublishableKeyError]: (name: string) => EnvError\n [MissingDefaultPublishableKeyError]: () => EnvError\n [MissingSecretKeyError]: (name: string) => EnvError\n [MissingDefaultSecretKeyError]: () => EnvError\n [InvalidCredentialsError]: () => AuthError\n [CreateSupabaseClientError]: () => AuthError\n}\n```" }, { "kind": "text", "text": "\n\nKeyed by error code constant. Each entry returns a pre-configured error instance." } ], "frontmatter": {} }, { "id": 4, "name": "auth-modes", "variant": "document", "kind": 8388608, "flags": {}, "content": [ { "kind": "text", "text": "# Auth Modes\n\n## Overview\n\nEvery request is validated against one or more auth modes before your handler runs. The " }, { "kind": "code", "text": "`auth`" }, { "kind": "text", "text": " config determines which modes are accepted.\n\n> **" }, { "kind": "code", "text": "`allow`" }, { "kind": "text", "text": " is deprecated.** The " }, { "kind": "code", "text": "`auth`" }, { "kind": "text", "text": " option replaces the legacy " }, { "kind": "code", "text": "`allow`" }, { "kind": "text", "text": " option. " }, { "kind": "code", "text": "`allow`" }, { "kind": "text", "text": " still works (with a one-time " }, { "kind": "code", "text": "`console.warn`" }, { "kind": "text", "text": ") but will be removed in a future major release. Migration is a find-and-replace: " }, { "kind": "code", "text": "`allow:`" }, { "kind": "text", "text": " → " }, { "kind": "code", "text": "`auth:`" }, { "kind": "text", "text": ".\n\n> **Breaking — auth API renamed.** " }, { "kind": "code", "text": "`'always'`" }, { "kind": "text", "text": " is now " }, { "kind": "code", "text": "`'none'`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`'public'`" }, { "kind": "text", "text": " is now " }, { "kind": "code", "text": "`'publishable'`" }, { "kind": "text", "text": " (including the colon variants " }, { "kind": "code", "text": "`'public:'`" }, { "kind": "text", "text": " → " }, { "kind": "code", "text": "`'publishable:'`" }, { "kind": "text", "text": "). The field on " }, { "kind": "code", "text": "`AuthResult`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`SupabaseContext`" }, { "kind": "text", "text": " was also renamed from " }, { "kind": "code", "text": "`authType`" }, { "kind": "text", "text": " to " }, { "kind": "code", "text": "`authMode`" }, { "kind": "text", "text": " so it matches the " }, { "kind": "code", "text": "`AuthMode`" }, { "kind": "text", "text": " type. The old names no longer work — update the option values you pass in **and** any runtime checks on " }, { "kind": "code", "text": "`ctx.authType`" }, { "kind": "text", "text": " (now " }, { "kind": "code", "text": "`ctx.authMode`" }, { "kind": "text", "text": ").\n\n| Mode | Credential required | Typical use case |\n| --------------- | -------------------------------------------------- | -------------------------------------- |\n| " }, { "kind": "code", "text": "`'user'`" }, { "kind": "text", "text": " | Valid JWT in " }, { "kind": "code", "text": "`Authorization: Bearer `" }, { "kind": "text", "text": " | Authenticated user endpoints |\n| " }, { "kind": "code", "text": "`'publishable'`" }, { "kind": "text", "text": " | Valid " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " publishable key in " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header | Client-facing, key-validated endpoints |\n| " }, { "kind": "code", "text": "`'secret'`" }, { "kind": "text", "text": " | Valid " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " secret key in " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header | Server-to-server, internal calls |\n| " }, { "kind": "code", "text": "`'none'`" }, { "kind": "text", "text": " | None | Open endpoints, custom auth wrappers |\n\n> **Bare " }, { "kind": "code", "text": "`'publishable'`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`'secret'`" }, { "kind": "text", "text": " match only the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key** in " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": ". Use " }, { "kind": "code", "text": "`secret:`" }, { "kind": "text", "text": " for a specific key or " }, { "kind": "code", "text": "`secret:*`" }, { "kind": "text", "text": " to accept any key in the set — see [Named key syntax](#named-key-syntax).\n\n> **Supabase Edge Functions:** By default, the platform requires a valid JWT on every request same as " }, { "kind": "code", "text": "`'user'`" }, { "kind": "text", "text": ".\n> If your function uses " }, { "kind": "code", "text": "`'publishable'`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`'secret'`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`'none'`" }, { "kind": "text", "text": ", disable the platform-level JWT check in " }, { "kind": "code", "text": "`supabase/config.toml`" }, { "kind": "text", "text": ":\n>\n> " }, { "kind": "code", "text": "```toml\n> [functions.my-function]\n> verify_jwt = false\n> ```" }, { "kind": "text", "text": "\n\n## User mode\n\nThe default. Verifies the JWT using your project's JWKS (JSON Web Key Set).\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase({ auth: 'user' }, async (_req, ctx) => {\n // ctx.userClaims has the caller's identity\n console.log(ctx.userClaims!.id) // \"d0f1a2b3-...\"\n console.log(ctx.userClaims!.email) // \"user@example.com\"\n console.log(ctx.userClaims!.role) // \"authenticated\"\n\n // ctx.jwtClaims has the raw JWT payload\n console.log(ctx.jwtClaims!.sub) // same as userClaims.id\n console.log(ctx.jwtClaims!.exp) // token expiration (epoch seconds)\n\n // ctx.supabase is scoped to this user — RLS applies\n const { data } = await ctx.supabase.from('todos').select()\n return Response.json(data)\n }),\n}\n```" }, { "kind": "text", "text": "\n\nThe caller must send:\n\n" }, { "kind": "code", "text": "```\nAuthorization: Bearer eyJhbGciOiJIUzI1NiIs...\n```" }, { "kind": "text", "text": "\n\n**" }, { "kind": "code", "text": "`userClaims`" }, { "kind": "text", "text": " vs " }, { "kind": "code", "text": "`supabase.auth.getUser()`" }, { "kind": "text", "text": ":** " }, { "kind": "code", "text": "`userClaims`" }, { "kind": "text", "text": " is extracted from the JWT and is available instantly — no network call. It includes " }, { "kind": "code", "text": "`id`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`email`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`role`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`appMetadata`" }, { "kind": "text", "text": ", and " }, { "kind": "code", "text": "`userMetadata`" }, { "kind": "text", "text": ". For the full Supabase " }, { "kind": "code", "text": "`User`" }, { "kind": "text", "text": " object (email confirmation status, providers, linked identities), call " }, { "kind": "code", "text": "`ctx.supabase.auth.getUser()`" }, { "kind": "text", "text": ", which makes a request to the auth server.\n\n## Publishable mode\n\nValidates that the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header contains a recognized publishable key. Uses timing-safe comparison to prevent timing attacks. See [" }, { "kind": "code", "text": "`security.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "security.md", "target": 7 }, { "kind": "text", "text": ") for details.\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase({ auth: 'publishable' }, async (_req, ctx) => {\n // ctx.userClaims is null — no JWT involved\n // ctx.supabase is initialized as anonymous (RLS anon role)\n const { data } = await ctx.supabase.from('products').select()\n return Response.json(data)\n }),\n}\n```" }, { "kind": "text", "text": "\n\nThe caller must send:\n\n" }, { "kind": "code", "text": "```\napikey: sb_publishable_abc123...\n```" }, { "kind": "text", "text": "\n\nBy default, " }, { "kind": "code", "text": "`publishable`" }, { "kind": "text", "text": " mode validates against the " }, { "kind": "code", "text": "`\"default\"`" }, { "kind": "text", "text": " key in " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": ". Use named key syntax to target a specific key or " }, { "kind": "code", "text": "`publishable:*`" }, { "kind": "text", "text": " to accept any key (see below).\n\n## Secret mode\n\nValidates that the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header contains a recognized secret key. Same timing-safe comparison as publishable mode. See [" }, { "kind": "code", "text": "`security.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "security.md", "target": 7 }, { "kind": "text", "text": ") for details.\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase({ auth: 'secret' }, async (_req, ctx) => {\n // ctx.supabaseAdmin bypasses RLS — use for privileged operations\n const { data } = await ctx.supabaseAdmin.from('config').select()\n return Response.json(data)\n }),\n}\n```" }, { "kind": "text", "text": "\n\nThe caller must send:\n\n" }, { "kind": "code", "text": "```\napikey: sb_secret_xyz789...\n```" }, { "kind": "text", "text": "\n\nBy default, " }, { "kind": "code", "text": "`secret`" }, { "kind": "text", "text": " mode validates against the " }, { "kind": "code", "text": "`\"default\"`" }, { "kind": "text", "text": " key in " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": ". Use named key syntax to target a specific key or " }, { "kind": "code", "text": "`secret:*`" }, { "kind": "text", "text": " to accept any key (see below).\n\n## None mode\n\nNo credentials required. Every request is accepted.\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase({ auth: 'none' }, async (_req, ctx) => {\n // ctx.authMode is 'none'\n // ctx.userClaims is null\n // ctx.supabase is anonymous (RLS anon role)\n return Response.json({ status: 'healthy' })\n }),\n}\n```" }, { "kind": "text", "text": "\n\nUse " }, { "kind": "code", "text": "`none`" }, { "kind": "text", "text": " for health checks, public APIs, or when you handle auth yourself inside the handler.\n\n## Array syntax (multiple modes)\n\nAccept multiple auth methods. Modes are tried in order — the first match wins.\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase({ auth: ['user', 'secret'] }, async (req, ctx) => {\n // ctx.authMode tells you which mode matched\n if (ctx.authMode === 'user') {\n // Called by an authenticated user\n const { data } = await ctx.supabase.from('reports').select()\n return Response.json(data)\n }\n\n // Called by another service with a secret key\n const { user_id } = await req.json()\n const { data } = await ctx.supabaseAdmin\n .from('reports')\n .select()\n .eq('user_id', user_id)\n return Response.json(data)\n }),\n}\n```" }, { "kind": "text", "text": "\n\nA request with a valid JWT matches " }, { "kind": "code", "text": "`'user'`" }, { "kind": "text", "text": ". A request with a valid secret key matches " }, { "kind": "code", "text": "`'secret'`" }, { "kind": "text", "text": ". A request with neither is rejected.\n\n**Fallthrough vs rejection.** A mode is only \"tried\" when its credential is actually present. A request with no " }, { "kind": "code", "text": "`Authorization`" }, { "kind": "text", "text": " header moves on to the next mode. But if a JWT _is_ present and fails verification (malformed, expired, wrong signature, or missing a " }, { "kind": "code", "text": "`sub`" }, { "kind": "text", "text": " claim), the request is rejected immediately with " }, { "kind": "code", "text": "`InvalidCredentialsError`" }, { "kind": "text", "text": " — it will not silently fall through to " }, { "kind": "code", "text": "`'publishable'`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`'secret'`" }, { "kind": "text", "text": ", or " }, { "kind": "code", "text": "`'none'`" }, { "kind": "text", "text": ". The same rule applies on the API-key side: " }, { "kind": "code", "text": "`'publishable'`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`'secret'`" }, { "kind": "text", "text": " fall through only when no " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header is sent. This prevents a bad credential from being downgraded to a less-privileged auth mode.\n\n## Named key syntax\n\nWhen your project has multiple API keys (e.g., separate keys for web, mobile, and internal services), use the colon syntax to validate against a specific named key.\n\nKeys are stored as a JSON object in " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": ":\n\n" }, { "kind": "code", "text": "```json\n{\n \"default\": \"sb_publishable_123...\",\n \"web\": \"sb_publishable_abc...\",\n \"mobile\": \"sb_publishable_a1b2...\"\n}\n```" }, { "kind": "text", "text": "\n\n### Target a specific key\n\n" }, { "kind": "code", "text": "```ts\n// Only accept the \"web\" publishable key\nwithSupabase({ auth: 'publishable:web' }, handler)\n\n// Only accept the \"internal\" secret key\nwithSupabase({ auth: 'secret:internal' }, handler)\n```" }, { "kind": "text", "text": "\n\n### Wildcard — accept any key in the set\n\n" }, { "kind": "code", "text": "```ts\n// Accept any publishable key\nwithSupabase({ auth: 'publishable:*' }, handler)\n\n// Accept any secret key\nwithSupabase({ auth: 'secret:*' }, handler)\n```" }, { "kind": "text", "text": "\n\n### Which key matched?\n\nWhen using named keys, " }, { "kind": "code", "text": "`ctx.authMode`" }, { "kind": "text", "text": " tells you the mode and " }, { "kind": "code", "text": "`keyName`" }, { "kind": "text", "text": " on the " }, { "kind": "code", "text": "`AuthResult`" }, { "kind": "text", "text": " (from core primitives) tells you which key matched. In the high-level " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " wrapper, the matched key is used internally for client creation.\n\n### Combining named keys with other modes\n\n" }, { "kind": "code", "text": "```ts\nwithSupabase({ auth: ['user', 'publishable:web'] }, async (_req, ctx) => {\n // Accepts either a valid JWT or the \"web\" publishable key\n return Response.json({ authMode: ctx.authMode })\n})\n```" }, { "kind": "text", "text": "\n\n## How auth flows through the system\n\n1. " }, { "kind": "code", "text": "`extractCredentials(request)`" }, { "kind": "text", "text": " reads " }, { "kind": "code", "text": "`Authorization: Bearer `" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " from headers\n2. Each mode in " }, { "kind": "code", "text": "`auth`" }, { "kind": "text", "text": " is tried in order against the extracted credentials\n3. First match wins — returns an " }, { "kind": "code", "text": "`AuthResult`" }, { "kind": "text", "text": " with " }, { "kind": "code", "text": "`authMode`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`token`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`userClaims`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`jwtClaims`" }, { "kind": "text", "text": ", and " }, { "kind": "code", "text": "`keyName`" }, { "kind": "text", "text": ". A mode falls through to the next only when its credential is absent; a credential that is present but invalid terminates the chain with " }, { "kind": "code", "text": "`InvalidCredentialsError`" }, { "kind": "text", "text": ".\n4. The auth result is used to create scoped clients (" }, { "kind": "code", "text": "`supabase`" }, { "kind": "text", "text": " with the user's token, " }, { "kind": "code", "text": "`supabaseAdmin`" }, { "kind": "text", "text": " with the secret key)\n5. Everything is bundled into a " }, { "kind": "code", "text": "`SupabaseContext`" }, { "kind": "text", "text": " and passed to your handler" } ], "frontmatter": {} }, { "id": 5, "name": "environment-variables", "variant": "document", "kind": 8388608, "flags": {}, "content": [ { "kind": "text", "text": "## Supabase environments (zero config)\n\nOn Supabase Platform and Local Development (CLI), all variables are auto-provisioned — no configuration needed\n\n| Variable | Format | Description | Available in |\n| --------------------------- | ---------------------------------- | -------------------------------------------- | --------------------------------- |\n| " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`https://.supabase.co`" }, { "kind": "text", "text": " | Your Supabase project URL | All |\n| " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`{\"default\":\"sb_publishable_...\"}`" }, { "kind": "text", "text": " | Named publishable keys as JSON object | All |\n| " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`{\"default\":\"sb_secret_...\"}`" }, { "kind": "text", "text": " | Named secret keys as JSON object | All |\n| " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`{\"keys\":[...]}`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`[...]`" }, { "kind": "text", "text": " | Inline JSON Web Key Set for JWT verification | All |\n| " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEY`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`sb_publishable_...`" }, { "kind": "text", "text": " | Single publishable key (fallback) | Self-hosted, if manually exported |\n| " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEY`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`sb_secret_...`" }, { "kind": "text", "text": " | Single secret key (fallback) | Self-hosted, if manually exported |\n\n## Non-Supabase environments (Node.js, Bun, Cloudflare, self-hosted)\n\nSet these based on which auth modes your app uses:\n\n| Variable | Required when |\n| -------------------------------------- | ----------------------------------------- |\n| " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " | Always |\n| " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEY`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`auth: 'secret'`" }, { "kind": "text", "text": " or using " }, { "kind": "code", "text": "`supabaseAdmin`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEY`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`auth: 'publishable'`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`SUPABASE_JWKS_URL`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`auth: 'user'`" }, { "kind": "text", "text": " (JWT verification) |\n\n### Minimal " }, { "kind": "code", "text": "`.env`" }, { "kind": "text", "text": " example\n\n" }, { "kind": "code", "text": "```env\nSUPABASE_URL=https://.supabase.co\nSUPABASE_SECRET_KEY=sb_secret_...\nSUPABASE_PUBLISHABLE_KEY=sb_publishable_...\nSUPABASE_JWKS={\"keys\":[...]}\n```" }, { "kind": "text", "text": "\n\n## Plural vs singular keys\n\nThe SDK checks the plural form first (" }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": "), then falls back to the singular form (" }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEY`" }, { "kind": "text", "text": "). The same applies to secret keys.\n\n### Plural form — named keys as a JSON object\n\nUse this when you have multiple keys for different clients (web, mobile, internal):\n\n" }, { "kind": "code", "text": "```\nSUPABASE_PUBLISHABLE_KEYS={\"default\":\"sb_publishable_default_abc\",\"web\":\"sb_publishable_web_xyz\",\"mobile\":\"sb_publishable_mobile_123\"}\nSUPABASE_SECRET_KEYS={\"default\":\"sb_secret_default_abc\",\"internal\":\"sb_secret_internal_xyz\"}\n```" }, { "kind": "text", "text": "\n\nYou can then validate against specific keys with named key syntax:\n\n" }, { "kind": "code", "text": "```ts\n// Only accept the \"web\" publishable key\nwithSupabase({ auth: 'publishable:web' }, handler)\n\n// Accept any secret key\nwithSupabase({ auth: 'secret:*' }, handler)\n```" }, { "kind": "text", "text": "\n\n### Singular form — equivalent to a single \"default\" key\n\n" }, { "kind": "code", "text": "```\nSUPABASE_PUBLISHABLE_KEY=sb_publishable_default_abc\nSUPABASE_SECRET_KEY=sb_secret_default_abc\n```" }, { "kind": "text", "text": "\n\nThis is equivalent to setting the plural form with a single " }, { "kind": "code", "text": "`\"default\"`" }, { "kind": "text", "text": " entry:\n\n" }, { "kind": "code", "text": "```\n# These two are the same:\nSUPABASE_PUBLISHABLE_KEY=sb_publishable_default_abc\nSUPABASE_PUBLISHABLE_KEYS={\"default\":\"sb_publishable_default_abc\"}\n```" }, { "kind": "text", "text": "\n\nThe singular form is a convenience for the common case where you only have one key. The SDK stores it internally as " }, { "kind": "code", "text": "`{ default: \"\" }`" }, { "kind": "text", "text": ", so " }, { "kind": "code", "text": "`auth: 'publishable'`" }, { "kind": "text", "text": " (which looks for the " }, { "kind": "code", "text": "`\"default\"`" }, { "kind": "text", "text": " key) works with both forms.\n\n### Priority\n\nWhen both singular and plural forms are set, the plural form takes priority.\n\n## JWKS source\n\nJWT verification (" }, { "kind": "code", "text": "`auth: 'user'`" }, { "kind": "text", "text": ") needs a JWKS. There are two ways to provide one:\n\n" }, { "kind": "code", "text": "```\n# Inline JSON — standard JWKS format\nSUPABASE_JWKS={\"keys\":[{\"kty\":\"RSA\",\"n\":\"...\",\"e\":\"AQAB\"}]}\n\n# Inline JSON — bare array (convenience, wrapped as { keys: [...] })\nSUPABASE_JWKS=[{\"kty\":\"RSA\",\"n\":\"...\",\"e\":\"AQAB\"}]\n\n# Remote JWKS endpoint — keys are fetched on demand and cached in memory.\n# HTTPS is required for any non-loopback host; plain http:// is rejected\n# (a MITM on the JWKS fetch could swap in an attacker-controlled key and\n# forge JWTs that verify). http:// is allowed for loopback hosts only —\n# `localhost`, `127.0.0.0/8`, `::1` — to support the local Supabase CLI.\nSUPABASE_JWKS_URL=https://.supabase.co/auth/v1/.well-known/jwks.json\n\n# Local development against `supabase start`:\nSUPABASE_JWKS_URL=http://localhost:54321/auth/v1/.well-known/jwks.json\n```" }, { "kind": "text", "text": "\n\n### Resolution order\n\n1. " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " — when set, treated as authoritative inline JSON.\n2. " }, { "kind": "code", "text": "`SUPABASE_JWKS_URL`" }, { "kind": "text", "text": " — only checked when " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " is unset or empty.\n Must be " }, { "kind": "code", "text": "`https://`" }, { "kind": "text", "text": ", except loopback hosts may use " }, { "kind": "code", "text": "`http://`" }, { "kind": "text", "text": ".\n3. Otherwise — " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": ". JWT verification (" }, { "kind": "code", "text": "`auth: 'user'`" }, { "kind": "text", "text": ") is unavailable.\n\n## Runtime-specific behavior\n\nThe SDK reads environment variables using this priority:\n\n1. " }, { "kind": "code", "text": "`Deno.env.get(name)`" }, { "kind": "text", "text": " — Deno (including Supabase Edge Functions)\n2. " }, { "kind": "code", "text": "`process.env[name]`" }, { "kind": "text", "text": " — Node.js, Bun, Cloudflare Workers (with node-compat)\n\n### Supabase Edge Functions\n\nEnvironment variables are auto-provisioned by the platform. Nothing to configure.\n\n### Deno / Node.js / Bun\n\nSet variables via " }, { "kind": "code", "text": "`.env`" }, { "kind": "text", "text": " files (with a loader like " }, { "kind": "code", "text": "`dotenv`" }, { "kind": "text", "text": " for Node.js) or your deployment platform's environment configuration.\n\n### Cloudflare Workers\n\nCloudflare Workers don't expose " }, { "kind": "code", "text": "`Deno.env`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`process.env`" }, { "kind": "text", "text": " by default. Two options:\n\n1. **Enable node-compat** in " }, { "kind": "code", "text": "`wrangler.toml`" }, { "kind": "text", "text": ":\n\n " }, { "kind": "code", "text": "```toml\n compatibility_flags = [\"nodejs_compat\"]\n ```" }, { "kind": "text", "text": "\n\n2. **Pass overrides** via the " }, { "kind": "code", "text": "`env`" }, { "kind": "text", "text": " config option:\n\n " }, { "kind": "code", "text": "```ts\n withSupabase(\n {\n auth: 'user',\n env: {\n url: env.SUPABASE_URL,\n publishableKeys: { default: env.SUPABASE_PUBLISHABLE_KEY },\n secretKeys: { default: env.SUPABASE_SECRET_KEY },\n },\n },\n handler,\n )\n ```" }, { "kind": "text", "text": "\n\n## Using env overrides\n\nThe " }, { "kind": "code", "text": "`env`" }, { "kind": "text", "text": " option on " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`createSupabaseContext`" }, { "kind": "text", "text": ", and core primitives lets you override auto-detected values. Partial overrides are merged with what's resolved from environment variables:\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase(\n {\n auth: 'user',\n env: {\n url: 'http://localhost:54321', // override just the URL\n },\n },\n handler,\n ),\n}\n```" }, { "kind": "text", "text": "\n\n## Using resolveEnv directly\n\nFor manual environment resolution — useful in tests, custom setups, or debugging:\n\n" }, { "kind": "code", "text": "```ts\nimport { resolveEnv } from '@supabase/server/core'\n\nconst { data: env, error } = resolveEnv()\nif (error) {\n console.error(`Missing config: ${error.message}`)\n}\n\n// With overrides\nconst { data: envOverridden } = resolveEnv({\n url: 'http://localhost:54321',\n publishableKeys: { default: 'test-key' },\n})\n```" }, { "kind": "text", "text": "\n\n" }, { "kind": "code", "text": "`resolveEnv`" }, { "kind": "text", "text": " returns a " }, { "kind": "code", "text": "`SupabaseEnv`" }, { "kind": "text", "text": " object:\n\n" }, { "kind": "code", "text": "```ts\ninterface SupabaseEnv {\n url: string\n publishableKeys: Record\n secretKeys: Record\n // `URL` when SUPABASE_JWKS is a remote endpoint, `JsonWebKeySet` for inline keys\n jwks: JsonWebKeySet | URL | null\n}\n```" }, { "kind": "text", "text": "\n\n## Graceful parsing\n\nMalformed JSON in environment variables doesn't throw — the SDK falls back to empty values:\n\n- Malformed " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": " → empty " }, { "kind": "code", "text": "`{}`" }, { "kind": "text", "text": "\n- Malformed " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " → " }, { "kind": "code", "text": "`null`" }, { "kind": "text", "text": " (JWT verification unavailable)\n- Missing " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " → " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " (this is the only hard requirement)" } ], "frontmatter": {} }, { "id": 6, "name": "error-handling", "variant": "document", "kind": 8388608, "flags": {}, "content": [ { "kind": "text", "text": "# Error Handling\n\n## Error classes\n\nThe SDK has two error classes, both with " }, { "kind": "code", "text": "`status`" }, { "kind": "text", "text": " (HTTP code) and " }, { "kind": "code", "text": "`code`" }, { "kind": "text", "text": " (machine-readable string) properties.\n\n### EnvError\n\nThrown when a required environment variable is missing or malformed. Always " }, { "kind": "code", "text": "`status: 500`" }, { "kind": "text", "text": " — these are server configuration issues, not client errors.\n\n| Code | Meaning |\n| --------------------------------- | -------------------------------------------------------------- |\n| " }, { "kind": "code", "text": "`MISSING_SUPABASE_URL`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " is not set |\n| " }, { "kind": "code", "text": "`MISSING_PUBLISHABLE_KEY`" }, { "kind": "text", "text": " | Named publishable key not found in " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`MISSING_DEFAULT_PUBLISHABLE_KEY`" }, { "kind": "text", "text": " | No default publishable key found |\n| " }, { "kind": "code", "text": "`MISSING_SECRET_KEY`" }, { "kind": "text", "text": " | Named secret key not found in " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`MISSING_DEFAULT_SECRET_KEY`" }, { "kind": "text", "text": " | No default secret key found |\n| " }, { "kind": "code", "text": "`ENV_ERROR`" }, { "kind": "text", "text": " | Generic environment error |\n\n### AuthError\n\nThrown when authentication or authorization fails. Status is " }, { "kind": "code", "text": "`401`" }, { "kind": "text", "text": " for invalid credentials, " }, { "kind": "code", "text": "`500`" }, { "kind": "text", "text": " for server-side auth failures.\n\n| Code | Status | Meaning |\n| ------------------------------ | ------ | ----------------------------------------------------------------------------------------- |\n| " }, { "kind": "code", "text": "`INVALID_CREDENTIALS`" }, { "kind": "text", "text": " | 401 | No credential matched any allowed auth mode, or a JWT was present but failed verification |\n| " }, { "kind": "code", "text": "`CREATE_SUPABASE_CLIENT_ERROR`" }, { "kind": "text", "text": " | 500 | Auth succeeded but client creation failed |\n| " }, { "kind": "code", "text": "`AUTH_ERROR`" }, { "kind": "text", "text": " | 401 | Generic authentication error |\n\n## How errors surface in each layer\n\nDifferent layers of the SDK handle errors differently. Understanding which pattern each function uses prevents surprises.\n\n| Function | Pattern | What happens on error |\n| ------------------------- | ------------- | ------------------------------------------------------------------------ |\n| " }, { "kind": "code", "text": "`withSupabase()`" }, { "kind": "text", "text": " | Auto-response | Returns " }, { "kind": "code", "text": "`Response.json({ message, code }, { status })`" }, { "kind": "text", "text": " with CORS headers |\n| " }, { "kind": "code", "text": "`createSupabaseContext()`" }, { "kind": "text", "text": " | Result tuple | Returns " }, { "kind": "code", "text": "`{ data: null, error: AuthError }`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`verifyAuth()`" }, { "kind": "text", "text": " | Result tuple | Returns " }, { "kind": "code", "text": "`{ data: null, error: AuthError }`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`verifyCredentials()`" }, { "kind": "text", "text": " | Result tuple | Returns " }, { "kind": "code", "text": "`{ data: null, error: AuthError }`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`resolveEnv()`" }, { "kind": "text", "text": " | Result tuple | Returns " }, { "kind": "code", "text": "`{ data: null, error: EnvError }`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`createContextClient()`" }, { "kind": "text", "text": " | **Throws** | Throws " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`createAdminClient()`" }, { "kind": "text", "text": " | **Throws** | Throws " }, { "kind": "code", "text": "`EnvError`" }, { "kind": "text", "text": " |\n| Hono " }, { "kind": "code", "text": "`withSupabase()`" }, { "kind": "text", "text": " | HTTPException | Throws " }, { "kind": "code", "text": "`HTTPException`" }, { "kind": "text", "text": " with " }, { "kind": "code", "text": "`cause: AuthError`" }, { "kind": "text", "text": " |\n\nThe two client factory functions (" }, { "kind": "code", "text": "`createContextClient`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`createAdminClient`" }, { "kind": "text", "text": ") are the only ones that throw. Everything else returns a result tuple " }, { "kind": "code", "text": "`{ data, error }`" }, { "kind": "text", "text": ".\n\n## Handling errors in withSupabase\n\n" }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " handles errors automatically. If auth fails, the caller receives a JSON response:\n\n" }, { "kind": "code", "text": "```json\n{ \"message\": \"Invalid credentials\", \"code\": \"INVALID_CREDENTIALS\" }\n```" }, { "kind": "text", "text": "\n\nwith the appropriate HTTP status code and CORS headers. Your handler never runs.\n\nIf you need custom error formatting, use " }, { "kind": "code", "text": "`createSupabaseContext`" }, { "kind": "text", "text": " instead:\n\n" }, { "kind": "code", "text": "```ts\nimport { createSupabaseContext } from '@supabase/server'\n\nexport default {\n fetch: async (req: Request) => {\n const { data: ctx, error } = await createSupabaseContext(req, {\n auth: 'user',\n })\n\n if (error) {\n // Custom error format\n return Response.json(\n {\n success: false,\n error: { message: error.message, code: error.code },\n },\n { status: error.status },\n )\n }\n\n const { data } = await ctx!.supabase.from('todos').select()\n return Response.json({ success: true, data })\n },\n}\n```" }, { "kind": "text", "text": "\n\n## Handling errors in Hono\n\nThe Hono adapter throws an " }, { "kind": "code", "text": "`HTTPException`" }, { "kind": "text", "text": " when auth fails. Access the original " }, { "kind": "code", "text": "`AuthError`" }, { "kind": "text", "text": " via " }, { "kind": "code", "text": "`.cause`" }, { "kind": "text", "text": ":\n\n" }, { "kind": "code", "text": "```ts\nimport { Hono } from 'hono'\nimport { HTTPException } from 'hono/http-exception'\nimport { withSupabase } from '@supabase/server/adapters/hono'\n\nconst app = new Hono()\n\napp.use('*', withSupabase({ auth: 'user' }))\n\napp.onError((err, c) => {\n if (err instanceof HTTPException && err.cause) {\n const authError = err.cause\n return c.json(\n { message: authError.message, code: authError.code },\n err.status,\n )\n }\n return c.json({ message: 'Internal error' }, 500)\n})\n```" }, { "kind": "text", "text": "\n\n## Handling errors in core primitives\n\nResult-tuple functions:\n\n" }, { "kind": "code", "text": "```ts\nimport { verifyAuth, resolveEnv } from '@supabase/server/core'\n\n// verifyAuth returns { data, error }\nconst { data: auth, error } = await verifyAuth(request, { auth: 'user' })\nif (error) {\n return Response.json({ message: error.message }, { status: error.status })\n}\n\n// resolveEnv returns { data, error }\nconst { data: env, error: envError } = resolveEnv()\nif (envError) {\n console.error(`Config issue [${envError.code}]: ${envError.message}`)\n}\n```" }, { "kind": "text", "text": "\n\nClient factories throw — wrap them in try/catch:\n\n" }, { "kind": "code", "text": "```ts\nimport {\n verifyAuth,\n createContextClient,\n createAdminClient,\n} from '@supabase/server/core'\nimport { EnvError } from '@supabase/server'\n\nconst { data: auth, error } = await verifyAuth(request, { auth: 'user' })\n// ... handle error ...\n\ntry {\n const supabase = createContextClient({ auth: { token: auth!.token } })\n const supabaseAdmin = createAdminClient()\n} catch (e) {\n if (e instanceof EnvError) {\n console.error(`Config issue [${e.code}]: ${e.message}`)\n return Response.json({ message: e.message }, { status: 500 })\n }\n throw e\n}\n```" }, { "kind": "text", "text": "\n\n## Using the Errors factory map\n\nThe " }, { "kind": "code", "text": "`Errors`" }, { "kind": "text", "text": " object provides factory functions for creating error instances by code. Useful when building custom error handling or testing:\n\n" }, { "kind": "code", "text": "```ts\nimport {\n Errors,\n MissingSupabaseURLError,\n InvalidCredentialsError,\n} from '@supabase/server'\n\n// Create specific errors\nconst envError = Errors[MissingSupabaseURLError]()\n// → EnvError { message: \"SUPABASE_URL is required but not set\", code: \"MISSING_SUPABASE_URL\", status: 500 }\n\nconst authError = Errors[InvalidCredentialsError]()\n// → AuthError { message: \"Invalid credentials\", code: \"INVALID_CREDENTIALS\", status: 401 }\n```" }, { "kind": "text", "text": "\n\n## Checking error types\n\n" }, { "kind": "code", "text": "```ts\nimport { AuthError, EnvError } from '@supabase/server'\n\ntry {\n // ... some operation\n} catch (e) {\n if (e instanceof AuthError) {\n // e.status is 401 or 500\n // e.code is 'INVALID_CREDENTIALS', 'CREATE_SUPABASE_CLIENT_ERROR', or 'AUTH_ERROR'\n }\n if (e instanceof EnvError) {\n // e.status is always 500\n // e.code is one of the MISSING_* constants or 'ENV_ERROR'\n }\n}\n```" } ], "frontmatter": {} }, { "id": 7, "name": "security", "variant": "document", "kind": 8388608, "flags": {}, "content": [ { "kind": "text", "text": "# Security\n\nThis document explains the security decisions behind " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": ". It's informational — you don't need to read this to use the package, but it helps if you want to understand why things work the way they do.\n\n## Timing-safe credential comparison\n\nAPI keys are compared using constant-time comparison to prevent [timing attacks](https://en.wikipedia.org/wiki/Timing_attack).\n\nA naive string comparison (" }, { "kind": "code", "text": "`===`" }, { "kind": "text", "text": ") short-circuits on the first mismatched character. An attacker can measure response times to guess the key one character at a time. With enough requests, this leaks the full key.\n\nThe package uses a **double-HMAC technique**: both strings are HMAC'd with a random ephemeral key, then the resulting digests are compared byte-by-byte with a constant-time XOR loop. This ensures that comparison time is independent of where (or whether) the strings differ.\n\nThis applies to:\n\n- **Publishable key verification** (" }, { "kind": "code", "text": "`auth: 'publishable'`" }, { "kind": "text", "text": ") — compares the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header against stored publishable keys\n- **Secret key verification** (" }, { "kind": "code", "text": "`auth: 'secret'`" }, { "kind": "text", "text": ") — compares the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header against stored secret keys\n\nSee " }, { "kind": "code", "text": "`src/core/utils/timing-safe-equal.ts`" }, { "kind": "text", "text": " for the implementation.\n\n## Auth mode security model\n\nEach auth mode provides a different level of trust:\n\n| Mode | What it verifies | Who the caller is | " }, { "kind": "code", "text": "`supabase`" }, { "kind": "text", "text": " client | " }, { "kind": "code", "text": "`supabaseAdmin`" }, { "kind": "text", "text": " client |\n| ------------- | --------------------------------------- | ------------------------ | ------------------ | ---------------------- |\n| " }, { "kind": "code", "text": "`user`" }, { "kind": "text", "text": " | JWT signature against JWKS | An authenticated user | Row-Level Security | Full access |\n| " }, { "kind": "code", "text": "`publishable`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " publishable key (timing-safe) | A known client app | Row-Level Security | Full access |\n| " }, { "kind": "code", "text": "`secret`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " secret key (timing-safe) | A trusted server/service | Full access | Full access |\n| " }, { "kind": "code", "text": "`none`" }, { "kind": "text", "text": " | Nothing — all requests are accepted | Unknown | Row-Level Security | Full access |\n\nFor " }, { "kind": "code", "text": "`publishable`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`secret`" }, { "kind": "text", "text": ", the bare mode matches only the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key; use " }, { "kind": "code", "text": "`publishable:`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`secret:`" }, { "kind": "text", "text": " for a specific key or " }, { "kind": "code", "text": "`publishable:*`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`secret:*`" }, { "kind": "text", "text": " to accept any key in the set.\n\nKey implications:\n\n- **" }, { "kind": "code", "text": "`user`" }, { "kind": "text", "text": " mode** verifies the JWT using a local JWKS (JSON Web Key Set). The token must contain a " }, { "kind": "code", "text": "`sub`" }, { "kind": "text", "text": " claim. Verification uses the " }, { "kind": "code", "text": "`jose`" }, { "kind": "text", "text": " library's " }, { "kind": "code", "text": "`jwtVerify`" }, { "kind": "text", "text": " with a local key set — no network calls to an auth server.\n- **" }, { "kind": "code", "text": "`publishable`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`secret`" }, { "kind": "text", "text": " modes** compare the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header against known keys. The comparison is timing-safe. Bare " }, { "kind": "code", "text": "`auth: 'publishable'`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`auth: 'secret'`" }, { "kind": "text", "text": " match only the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key; use named keys (" }, { "kind": "code", "text": "`auth: 'secret:automations'`" }, { "kind": "text", "text": ") to accept only that specific key — this follows the principle of least privilege — or the wildcard (" }, { "kind": "code", "text": "`auth: 'secret:*'`" }, { "kind": "text", "text": ") to accept any key in the set.\n- **" }, { "kind": "code", "text": "`none`" }, { "kind": "text", "text": " mode** performs zero authentication. The handler runs for every request. The " }, { "kind": "code", "text": "`supabaseAdmin`" }, { "kind": "text", "text": " client is still available, so a compromised " }, { "kind": "code", "text": "`none`" }, { "kind": "text", "text": " endpoint with write operations is a security risk. Only use it for truly public endpoints or when you implement your own auth (e.g., webhook signature verification).\n\n## Named key isolation\n\nBare " }, { "kind": "code", "text": "`auth: 'secret'`" }, { "kind": "text", "text": " matches only the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key. You can restrict an endpoint to a specific named key, or accept any key in the set with the wildcard:\n\n" }, { "kind": "code", "text": "```ts\n// Matches only the \"default\" secret key\nwithSupabase({ auth: 'secret' }, handler)\n\n// Only accepts the \"automations\" secret key\nwithSupabase({ auth: 'secret:automations' }, handler)\n\n// Accepts any secret key in the set\nwithSupabase({ auth: 'secret:*' }, handler)\n```" }, { "kind": "text", "text": "\n\nThis limits the blast radius if a key is compromised. An attacker with the " }, { "kind": "code", "text": "`web`" }, { "kind": "text", "text": " publishable key cannot access an endpoint that requires " }, { "kind": "code", "text": "`secret:automations`" }, { "kind": "text", "text": ". Named keys also make it easier to rotate or revoke access for a specific consumer without affecting others.\n\n## JWT verification\n\nJWT verification in " }, { "kind": "code", "text": "`user`" }, { "kind": "text", "text": " mode works as follows:\n\n1. The " }, { "kind": "code", "text": "`Authorization: Bearer `" }, { "kind": "text", "text": " header is extracted from the request\n2. The token is verified against the JWKS from the " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " environment variable\n3. Verification uses " }, { "kind": "code", "text": "`jose`" }, { "kind": "text", "text": "'s " }, { "kind": "code", "text": "`jwtVerify`" }, { "kind": "text", "text": " with a **local** key set — there are no network calls to a JWKS endpoint\n4. The token must contain a " }, { "kind": "code", "text": "`sub`" }, { "kind": "text", "text": " (subject) claim to be considered valid\n5. On success, the decoded claims are available as " }, { "kind": "code", "text": "`ctx.userClaims`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`ctx.jwtClaims`" }, { "kind": "text", "text": "\n\nIf JWKS is not configured (" }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " is missing or malformed), " }, { "kind": "code", "text": "`user`" }, { "kind": "text", "text": " mode is unavailable and will always reject requests.\n\n**No silent downgrade.** When " }, { "kind": "code", "text": "`user`" }, { "kind": "text", "text": " is combined with other modes (e.g. " }, { "kind": "code", "text": "`auth: ['user', 'publishable']`" }, { "kind": "text", "text": "), a JWT that is present but fails verification rejects the request with " }, { "kind": "code", "text": "`InvalidCredentialsError`" }, { "kind": "text", "text": " — it does not fall through to the next mode. This prevents a bad token paired with a valid " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " (or with " }, { "kind": "code", "text": "`'none'`" }, { "kind": "text", "text": ") from being silently downgraded to a less-privileged auth mode. Requests that simply omit the " }, { "kind": "code", "text": "`Authorization`" }, { "kind": "text", "text": " header still fall through as expected.\n\n## CORS handling\n\n" }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " handles CORS automatically:\n\n- **Preflight requests** (" }, { "kind": "code", "text": "`OPTIONS`" }, { "kind": "text", "text": ") return " }, { "kind": "code", "text": "`204`" }, { "kind": "text", "text": " with CORS headers and skip the handler entirely — no auth check runs\n- **All other requests** get CORS headers appended to the response\n- **Error responses** (auth failures) also include CORS headers, so the browser can read the error\n\nCORS defaults come from " }, { "kind": "code", "text": "`@supabase/supabase-js/cors`" }, { "kind": "text", "text": ". You can pass custom headers or disable CORS entirely with " }, { "kind": "code", "text": "`cors: false`" }, { "kind": "text", "text": ".\n\nThe Hono adapter does **not** handle CORS — use Hono's built-in " }, { "kind": "code", "text": "`cors`" }, { "kind": "text", "text": " middleware instead.\n\n## Credential extraction\n\nCredentials are extracted from two standard headers:\n\n- " }, { "kind": "code", "text": "`Authorization: Bearer `" }, { "kind": "text", "text": " → used by " }, { "kind": "code", "text": "`user`" }, { "kind": "text", "text": " mode\n- " }, { "kind": "code", "text": "`apikey: `" }, { "kind": "text", "text": " → used by " }, { "kind": "code", "text": "`publishable`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`secret`" }, { "kind": "text", "text": " modes\n\nExtraction is a separate step from verification (" }, { "kind": "code", "text": "`extractCredentials`" }, { "kind": "text", "text": " vs " }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": "). This separation means you can inspect raw credentials in custom flows without triggering validation." } ], "frontmatter": {} }, { "id": 8, "name": "ssr-frameworks", "variant": "document", "kind": 8388608, "flags": {}, "content": [ { "kind": "text", "text": "# Cookie-based environments (Next.js, SvelteKit, Remix)\n\n## When you need this\n\nIn cookie-based frameworks like Next.js, Nuxt, SvelteKit, and Remix, the user's JWT lives in session cookies rather than the " }, { "kind": "code", "text": "`Authorization`" }, { "kind": "text", "text": " header. The high-level wrappers (" }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`createSupabaseContext`" }, { "kind": "text", "text": ") expect a standard " }, { "kind": "code", "text": "`Request`" }, { "kind": "text", "text": " with auth headers, so they don't work directly here.\n\nThe recommended pattern is to **compose " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": " with [" }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": "](https://github.com/supabase/ssr)**:\n\n- " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " owns the cookie session lifecycle — reads cookies, writes cookies, and handles refresh-token rotation via middleware.\n- " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": " adds JWT verification (" }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": "), an RLS-scoped server client (" }, { "kind": "code", "text": "`createContextClient`" }, { "kind": "text", "text": "), and a service-role client (" }, { "kind": "code", "text": "`createAdminClient`" }, { "kind": "text", "text": ") on top.\n\nYou hand " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": "'s fresh access token to " }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": ", then build typed clients from the result.\n\n## How the pieces fit\n\n1. **" }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " middleware** runs on every request and refreshes the access token cookie. Without it, the cookie goes stale, " }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": " rejects expired tokens, and the user appears logged out — even with a valid refresh token. (Server Components can't write cookies, which is why the refresh has to happen in middleware.)\n2. **" }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " " }, { "kind": "code", "text": "`createServerClient`" }, { "kind": "text", "text": "** runs inside your Server Component / Route Handler, reads the (now-fresh) cookie, and exposes " }, { "kind": "code", "text": "`auth.getSession()`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`auth.getUser()`" }, { "kind": "text", "text": ".\n3. **" }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": "** from " }, { "kind": "code", "text": "`@supabase/server/core`" }, { "kind": "text", "text": " cryptographically verifies that access token against JWKS and returns the parsed claims.\n4. **" }, { "kind": "code", "text": "`createContextClient`" }, { "kind": "text", "text": "** builds an RLS-scoped " }, { "kind": "code", "text": "`supabase-js`" }, { "kind": "text", "text": " client bound to the verified token.\n5. **" }, { "kind": "code", "text": "`createAdminClient`" }, { "kind": "text", "text": "** builds a service-role client (no token needed).\n\n## Step 1 — " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " middleware (refresh-token rotation)\n\nThis middleware is required. It refreshes the access token cookie before any Server Component or Route Handler runs:\n\n" }, { "kind": "code", "text": "```ts\n// middleware.ts\nimport { createServerClient } from '@supabase/ssr'\nimport { NextResponse, type NextRequest } from 'next/server'\n\nexport async function middleware(request: NextRequest) {\n let supabaseResponse = NextResponse.next({ request })\n\n const supabase = createServerClient(\n process.env.NEXT_PUBLIC_SUPABASE_URL!,\n process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY!,\n {\n cookies: {\n getAll() {\n return request.cookies.getAll()\n },\n setAll(cookiesToSet) {\n cookiesToSet.forEach(({ name, value }) =>\n request.cookies.set(name, value),\n )\n supabaseResponse = NextResponse.next({ request })\n cookiesToSet.forEach(({ name, value, options }) =>\n supabaseResponse.cookies.set(name, value, options),\n )\n },\n },\n },\n )\n\n // Triggers refresh-token rotation and writes the new cookies via setAll.\n await supabase.auth.getUser()\n\n return supabaseResponse\n}\n\nexport const config = {\n matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],\n}\n```" }, { "kind": "text", "text": "\n\nIf you skip this middleware, the cookie's access token will eventually expire and " }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": " will reject the request.\n\n## Step 2 — composed adapter\n\nThe adapter reads the (middleware-refreshed) cookie via " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": ", then hands the access token to " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": "'s primitives. The return shape matches the high-level " }, { "kind": "code", "text": "`createSupabaseContext`" }, { "kind": "text", "text": ", so callers see a familiar " }, { "kind": "code", "text": "`{ supabase, supabaseAdmin, userClaims, jwtClaims, authMode }`" }, { "kind": "text", "text": " bundle.\n\n" }, { "kind": "code", "text": "```ts\n// lib/supabase/context.ts\nimport { createServerClient } from '@supabase/ssr'\nimport { cookies } from 'next/headers'\nimport {\n verifyCredentials,\n createContextClient,\n createAdminClient,\n} from '@supabase/server/core'\nimport type {\n AuthModeWithKey,\n SupabaseContext,\n SupabaseEnv,\n} from '@supabase/server'\n\nfunction resolveNextEnv(): Partial {\n const url = process.env.NEXT_PUBLIC_SUPABASE_URL\n const publishableKey = process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY\n const secretKey = process.env.SUPABASE_SECRET_KEY\n\n return {\n url: url ?? undefined,\n publishableKeys: publishableKey ? { default: publishableKey } : {},\n secretKeys: secretKey ? { default: secretKey } : {},\n }\n}\n\nlet cachedJwks: SupabaseEnv['jwks'] = null\n\nasync function getJwks(supabaseUrl: string): Promise {\n if (cachedJwks) return cachedJwks\n try {\n const res = await fetch(`${supabaseUrl}/auth/v1/.well-known/jwks.json`)\n if (!res.ok) return null\n cachedJwks = await res.json()\n return cachedJwks\n } catch {\n return null\n }\n}\n\nexport async function createSupabaseContext(\n options: { auth?: AuthModeWithKey | AuthModeWithKey[] } = { auth: 'user' },\n): Promise<\n { data: SupabaseContext; error: null } | { data: null; error: Error }\n> {\n const nextEnv = resolveNextEnv()\n\n if (!nextEnv.url || !nextEnv.publishableKeys?.default) {\n return {\n data: null,\n error: new Error('Missing SUPABASE_URL or SUPABASE_PUBLISHABLE_KEY'),\n }\n }\n\n // Read the @supabase/ssr session cookie. The middleware above has already\n // refreshed the access token, so getSession() returns a fresh JWT.\n const cookieStore = await cookies()\n const ssrClient = createServerClient(\n nextEnv.url,\n nextEnv.publishableKeys.default,\n {\n cookies: {\n getAll() {\n return cookieStore.getAll()\n },\n setAll(cookiesToSet) {\n try {\n cookiesToSet.forEach(({ name, value, options }) =>\n cookieStore.set(name, value, options),\n )\n } catch {\n // Server Components can't write cookies — middleware handles it.\n }\n },\n },\n },\n )\n\n const {\n data: { session },\n } = await ssrClient.auth.getSession()\n const token = session?.access_token ?? null\n\n const jwks = await getJwks(nextEnv.url)\n const env: Partial = { ...nextEnv, jwks }\n\n const { data: auth, error } = await verifyCredentials(\n { token, apikey: null },\n { auth: options.auth ?? 'user', env },\n )\n\n if (error) {\n return { data: null, error }\n }\n\n const supabase = createContextClient({\n auth: { token: auth!.token },\n env,\n })\n const supabaseAdmin = createAdminClient({ env })\n\n return {\n data: {\n supabase,\n supabaseAdmin,\n userClaims: auth!.userClaims,\n jwtClaims: auth!.jwtClaims,\n authMode: auth!.authMode,\n },\n error: null,\n }\n}\n```" }, { "kind": "text", "text": "\n\n## Does this replace " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": "?\n\nNo. " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " handles cookie-based session management for frameworks like Next.js and SvelteKit. " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": " handles stateless, header-based auth for Edge Functions, Workers, and other backend runtimes. As you can see in the Next.js example above, the composable primitives already work in SSR environments but require more setup. The two packages coexist and are not replacements for each other. Deeper integration with " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " is on the roadmap.\n\n## Environment variable bridging\n\nSSR frameworks often use their own naming conventions for environment variables. Map them to a " }, { "kind": "code", "text": "`Partial`" }, { "kind": "text", "text": " that the core primitives expect:\n\n" }, { "kind": "code", "text": "```ts\nimport type { SupabaseEnv } from '@supabase/server'\n\nfunction resolveEnvFromFramework(): Partial {\n // Example: Next.js uses NEXT_PUBLIC_* for client-exposed vars\n const url = process.env.NEXT_PUBLIC_SUPABASE_URL\n const publishableKey = process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY\n const secretKey = process.env.SUPABASE_SECRET_KEY\n\n return {\n url: url ?? undefined,\n publishableKeys: publishableKey ? { default: publishableKey } : {},\n secretKeys: secretKey ? { default: secretKey } : {},\n // JWKS: either set SUPABASE_JWKS env var, or fetch it (see below)\n }\n}\n```" }, { "kind": "text", "text": "\n\n## JWKS resolution\n\nJWT verification requires a JWKS (JSON Web Key Set). Two options:\n\n**Option 1: Set the " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " environment variable.** This is auto-available on the Supabase platform and in local CLI. If set, the core primitives pick it up automatically — no extra code needed.\n\n**Option 2: Fetch from the well-known endpoint and cache.** Useful when deploying to environments where " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " isn't set:\n\n" }, { "kind": "code", "text": "```ts\nimport type { SupabaseEnv } from '@supabase/server'\n\nlet cachedJwks: SupabaseEnv['jwks'] = null\n\nasync function getJwks(supabaseUrl: string): Promise {\n if (cachedJwks) return cachedJwks\n\n try {\n const res = await fetch(`${supabaseUrl}/auth/v1/.well-known/jwks.json`)\n if (!res.ok) return null\n cachedJwks = await res.json()\n return cachedJwks\n } catch {\n return null\n }\n}\n```" }, { "kind": "text", "text": "\n\nThe cache lives in module scope, so it persists across requests for the lifetime of the server process. For serverless environments (e.g., Vercel), the cache is per-invocation — consider using an external cache or always setting " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": ".\n\n## Usage\n\n### In a Server Component\n\n" }, { "kind": "code", "text": "```tsx\n// app/page.tsx\nimport { createSupabaseContext } from '@/lib/supabase/context'\nimport { redirect } from 'next/navigation'\n\nexport default async function Home() {\n const { data: ctx, error } = await createSupabaseContext()\n\n if (error) {\n redirect('/auth/login')\n }\n\n const { data: todos } = await ctx!.supabase.from('todos').select()\n\n return (\n
    \n {todos?.map((t) => (\n
  • {t.title}
    • \n ))}\n
\n )\n}\n```" }, { "kind": "text", "text": "\n\n### In a Route Handler\n\n" }, { "kind": "code", "text": "```ts\n// app/api/todos/route.ts\nimport { createSupabaseContext } from '@/lib/supabase/context'\n\nexport async function GET() {\n const { data: ctx, error } = await createSupabaseContext()\n\n if (error) {\n return Response.json({ message: error.message }, { status: 401 })\n }\n\n const { data } = await ctx!.supabase.from('todos').select()\n return Response.json(data)\n}\n```" }, { "kind": "text", "text": "\n\n### With different auth modes\n\n" }, { "kind": "code", "text": "```ts\n// Public endpoint — no auth required\nconst { data: ctx } = await createSupabaseContext({ auth: 'none' })\n\n// Accept either user JWT or skip auth\nconst { data: ctx } = await createSupabaseContext({ auth: ['user', 'none'] })\n```" }, { "kind": "text", "text": "\n\n## Adapting for other frameworks\n\nThe adapter above is Next.js-specific only in how it wires " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": "'s cookie adapter. To adapt for another framework, swap the cookie adapter you pass to " }, { "kind": "code", "text": "`createServerClient`" }, { "kind": "text", "text": " from " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " — see " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": "'s framework guides for the canonical patterns:\n\n- **SvelteKit:** " }, { "kind": "code", "text": "`event.cookies.getAll()`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`event.cookies.set(name, value, options)`" }, { "kind": "text", "text": " in " }, { "kind": "code", "text": "`+page.server.ts`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`+server.ts`" }, { "kind": "text", "text": ".\n- **Remix:** parse cookies from " }, { "kind": "code", "text": "`request.headers.get('cookie')`" }, { "kind": "text", "text": " and emit them via " }, { "kind": "code", "text": "`Set-Cookie`" }, { "kind": "text", "text": " in the response.\n- **Nuxt:** use " }, { "kind": "code", "text": "`useCookie`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`getCookie`" }, { "kind": "text", "text": " / " }, { "kind": "code", "text": "`setCookie`" }, { "kind": "text", "text": " from " }, { "kind": "code", "text": "`h3`" }, { "kind": "text", "text": " inside server routes.\n\nEverything else — env bridging, JWKS fetching, " }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": ", client creation — stays the same." } ], "frontmatter": {} }, { "id": 9, "name": "typescript-generics", "variant": "document", "kind": 8388608, "flags": {}, "content": [ { "kind": "text", "text": "# TypeScript Generics\n\n## Overview\n\nAll client-creating functions accept a " }, { "kind": "code", "text": "`Database`" }, { "kind": "text", "text": " generic parameter. When you pass your generated database types, every " }, { "kind": "code", "text": "`.from('table').select()`" }, { "kind": "text", "text": " call is fully typed — column names, return types, insert shapes, and RPC signatures.\n\n## Generating types\n\nUse the Supabase CLI to generate TypeScript types from your database schema:\n\n" }, { "kind": "code", "text": "```bash\nnpx supabase gen types typescript --project-id your-project-ref > src/database.types.ts\n```" }, { "kind": "text", "text": "\n\nThis produces a " }, { "kind": "code", "text": "`Database`" }, { "kind": "text", "text": " type that describes your schema.\n\n## Using with withSupabase\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\nimport type { Database } from './database.types.ts'\n\nexport default {\n fetch: withSupabase({ auth: 'user' }, async (_req, ctx) => {\n // ctx.supabase is SupabaseClient\n // Fully typed: column names, return type, etc.\n const { data } = await ctx.supabase\n .from('todos')\n .select('id, title, completed')\n // data is { id: number; title: string; completed: boolean }[] | null\n return Response.json(data)\n }),\n}\n```" }, { "kind": "text", "text": "\n\n## Using with createSupabaseContext\n\n" }, { "kind": "code", "text": "```ts\nimport { createSupabaseContext } from '@supabase/server'\nimport type { Database } from './database.types.ts'\n\nconst { data: ctx, error } = await createSupabaseContext(request, {\n auth: 'user',\n})\n\nif (error) {\n throw error\n}\n\n// ctx.supabase and ctx.supabaseAdmin are both SupabaseClient\nconst { data } = await ctx!.supabase.from('profiles').select('id, email')\n```" }, { "kind": "text", "text": "\n\n## Using with core primitives\n\n" }, { "kind": "code", "text": "```ts\nimport {\n verifyAuth,\n createContextClient,\n createAdminClient,\n} from '@supabase/server/core'\nimport type { Database } from './database.types.ts'\n\nconst { data: auth } = await verifyAuth(request, { auth: 'user' })\n\nconst supabase = createContextClient({\n auth: { token: auth!.token },\n})\n\nconst supabaseAdmin = createAdminClient()\n\n// Both clients are fully typed\nconst { data: todos } = await supabase.from('todos').select()\nconst { data: users } = await supabaseAdmin.from('profiles').select()\n```" }, { "kind": "text", "text": "\n\n## Using with the Hono adapter\n\nPass an app environment type to " }, { "kind": "code", "text": "`Hono()`" }, { "kind": "text", "text": " so Hono knows the " }, { "kind": "code", "text": "`supabaseContext`" }, { "kind": "text", "text": " variable includes your generated database types:\n\n" }, { "kind": "code", "text": "```ts\nimport { Hono } from 'hono'\nimport { withSupabase } from '@supabase/server/adapters/hono'\nimport type { SupabaseContext } from '@supabase/server'\nimport type { Database } from './database.types.ts'\n\ntype Env = {\n Variables: {\n supabaseContext: SupabaseContext\n }\n}\n\nconst app = new Hono()\n\napp.use('*', withSupabase({ auth: 'user' }))\n\napp.get('/todos', async (c) => {\n const { supabase } = c.var.supabaseContext\n const { data } = await supabase.from('todos').select('id, title')\n return c.json(data)\n})\n```" }, { "kind": "text", "text": "\n\n## Custom schema\n\nIf your tables are in a schema other than " }, { "kind": "code", "text": "`public`" }, { "kind": "text", "text": ", pass it via " }, { "kind": "code", "text": "`supabaseOptions`" }, { "kind": "text", "text": ":\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\nimport type { Database } from './database.types.ts'\n\nexport default {\n fetch: withSupabase(\n {\n auth: 'user',\n supabaseOptions: { db: { schema: 'api' } },\n },\n async (_req, ctx) => {\n // Queries target the 'api' schema\n const { data } = await ctx.supabase.from('todos').select()\n return Response.json(data)\n },\n ),\n}\n```" }, { "kind": "text", "text": "\n\n## Forwarding other Supabase client options\n\n" }, { "kind": "code", "text": "`supabaseOptions`" }, { "kind": "text", "text": " accepts the same options as " }, { "kind": "code", "text": "`createClient()`" }, { "kind": "text", "text": " from " }, { "kind": "code", "text": "`@supabase/supabase-js`" }, { "kind": "text", "text": ", with two exceptions:\n\n- " }, { "kind": "code", "text": "`accessToken`" }, { "kind": "text", "text": " is stripped — token injection is managed by the SDK from verified credentials\n- Auth settings (" }, { "kind": "code", "text": "`persistSession`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`autoRefreshToken`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`detectSessionInUrl`" }, { "kind": "text", "text": ") are force-set to server-safe values\n\n" }, { "kind": "code", "text": "```ts\nwithSupabase(\n {\n auth: 'user',\n supabaseOptions: {\n db: { schema: 'api' },\n global: {\n headers: { 'x-custom-header': 'value' },\n },\n },\n },\n handler,\n)\n```" }, { "kind": "text", "text": "\n\nNote: " }, { "kind": "code", "text": "`Authorization`" }, { "kind": "text", "text": " and " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " headers in " }, { "kind": "code", "text": "`supabaseOptions.global.headers`" }, { "kind": "text", "text": " are sanitized (removed) to prevent overriding the verified credentials." } ], "frontmatter": {} } ], "childrenIncludingDocuments": [ 1, 2, 3, 4, 5, 6, 7, 8, 9, 14, 13, 12, 11, 10 ], "groups": [ { "title": "Documents", "children": [ 1, 2, 3, 4, 5, 6, 7, 8, 9 ] }, { "title": "Modules", "children": [ 14, 13, 12, 11, 10 ] } ], "packageName": "@supabase/server", "packageVersion": "1.4.0", "readme": [ { "kind": "text", "text": "# @supabase/server\n\n[![License](https://img.shields.io/npm/l/nx.svg?style=flat-square)](./LICENSE)\n[![Package](https://img.shields.io/npm/v/@supabase/server)](https://www.npmjs.com/package/@supabase/server)\n[![pkg.pr.new](https://pkg.pr.new/badge/supabase/server)](https://pkg.pr.new/~/supabase/server)\n[![Docs](https://img.shields.io/badge/docs-supabase.github.io-3ECF8E?logo=readthedocs&logoColor=white)](https://supabase.github.io/server/)\n\n> **v1.X — Public Beta.** First stable release under SemVer: breaking changes only ship as a major bump. The package is still early — expect new adapters, ergonomic improvements, and features to land frequently in minor releases. Found a rough edge? [Open an issue](https://github.com/supabase/server/issues) or [submit a PR](https://github.com/supabase/server/blob/main/CONTRIBUTING.md).\n\n> **Coming from a " }, { "kind": "code", "text": "`0.x`" }, { "kind": "text", "text": " release?** See [MIGRATION.md](" }, { "kind": "relative-link", "text": "MIGRATION.md", "target": 16 }, { "kind": "text", "text": ") for the v0 → v1 rename map (" }, { "kind": "code", "text": "`allow`" }, { "kind": "text", "text": " → " }, { "kind": "code", "text": "`auth`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`'public'`" }, { "kind": "text", "text": " → " }, { "kind": "code", "text": "`'publishable'`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`authType`" }, { "kind": "text", "text": " → " }, { "kind": "code", "text": "`authMode`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`claims`" }, { "kind": "text", "text": " → " }, { "kind": "code", "text": "`jwtClaims`" }, { "kind": "text", "text": ", …).\n\n" }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": " gives you batteries included access to the\n[supabase-js SDK](https://github.com/supabase/supabase-js), including client\ncreation and authentication automatically scoped to the inbound requests to your\nEdge Functions and APIs.\n\n" }, { "kind": "code", "text": "```ts\nimport { withSupabase } from '@supabase/server'\n\nexport default {\n fetch: withSupabase({ auth: 'user' }, async (_req, ctx) => {\n // RLS-scoped — this user only sees their own favorites\n const { data: myGames } = await ctx.supabase.from('favorite_games').select()\n return Response.json(myGames)\n }),\n}\n```" }, { "kind": "text", "text": "\n\nOne import. One line of config. Auth is validated, clients are ready, CORS is handled. Your handler only runs on successful auth.\n\n## Installation\n\n" }, { "kind": "code", "text": "```bash\n# Deno / Supabase Edge Functions (no install — import directly)\nimport { withSupabase } from \"npm:@supabase/server\";\n\n# npm\nnpm install @supabase/server\n\n# pnpm\npnpm add @supabase/server\n```" }, { "kind": "text", "text": "\n\n### AI coding skills\n\nInstall the skill so your AI coding agent (Claude Code, Cursor, etc.) knows how to use this package:\n\n" }, { "kind": "code", "text": "```bash\nnpx skills add supabase/server\n```" }, { "kind": "text", "text": "\n\n## Quick Start\n\nImagine you're building an app where users track their favorite games. They sign in and manage their own list. Pre-login screens browse the public catalog. An admin dashboard curates featured titles. A cron job refreshes the \"popular this week\" rankings. Here's how each piece looks:\n\n### Authenticated endpoint\n\n" }, { "kind": "code", "text": "```ts\n// A signed-in user fetches their favorite games.\nexport default {\n fetch: withSupabase({ auth: 'user' }, async (_req, ctx) => {\n const { supabase, supabaseAdmin, userClaims, jwtClaims, authMode } = ctx\n // supabase — RLS-scoped to the authenticated user\n // supabaseAdmin — bypasses RLS (service role)\n // userClaims — user identity from JWT (id, email, role)\n // jwtClaims — full JWT claims\n // authMode — which auth mode matched\n\n // RLS-scoped — this user only sees their own favorites\n const { data: myGames } = await supabase.from('favorite_games').select()\n return Response.json(myGames)\n }),\n}\n```" }, { "kind": "text", "text": "\n\n### Public endpoint (no auth)\n\n" }, { "kind": "code", "text": "```ts\n// The frontend hits this before showing the login screen.\n// auth: 'none' means no credentials required.\nexport default {\n fetch: withSupabase({ auth: 'none' }, async (_req, _ctx) => {\n return Response.json({ status: 'ok' })\n }),\n}\n```" }, { "kind": "text", "text": "\n\n### Publishable-key endpoint\n\n" }, { "kind": "code", "text": "```ts\n// The mobile app browses the game catalog before the user signs in.\n// auth: 'publishable' validates the apikey header against a publishable key —\n// gating the endpoint to your own clients while staying anonymous to the DB.\nexport default {\n fetch: withSupabase({ auth: 'publishable' }, async (_req, ctx) => {\n // ctx.supabase — anonymous (anon role); RLS still applies\n // ctx.userClaims, ctx.jwtClaims — null (no JWT)\n // ctx.authMode === 'publishable', ctx.authKeyName === 'default'\n const { data: catalog } = await ctx.supabase\n .from('games')\n .select('id, name, cover_url')\n return Response.json(catalog)\n }),\n}\n```" }, { "kind": "text", "text": "\n\nThe mobile app sends the publishable key in the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header:\n\n" }, { "kind": "code", "text": "```ts\nconst catalogEndpoint = 'https://.supabase.co/functions/v1/catalog'\nconst publishableKey = 'sb_publishable_...'\n\nawait fetch(catalogEndpoint, { headers: { apikey: publishableKey } })\n```" }, { "kind": "text", "text": "\n\n> Unlike " }, { "kind": "code", "text": "`auth: 'secret'`" }, { "kind": "text", "text": ", the " }, { "kind": "code", "text": "`supabase`" }, { "kind": "text", "text": " client here is anonymous, not admin — RLS is the source of truth for what's visible. The publishable key acts as a coarse \"this request came from a known client\" gate; it isn't a user identity.\n\n### API key protected\n\n" }, { "kind": "code", "text": "```ts\n// An admin dashboard fetches the list of featured games to curate.\n// Secret key auth (not a user JWT) — supabaseAdmin bypasses RLS.\nexport default {\n fetch: withSupabase({ auth: 'secret' }, async (_req, ctx) => {\n const { data: featuredGames } = await ctx.supabaseAdmin\n .from('featured_games')\n .select()\n return Response.json(featuredGames)\n }),\n}\n```" }, { "kind": "text", "text": "\n\n### Dual auth (user or service)\n\n" }, { "kind": "code", "text": "```ts\n// Users view their own play stats from the app (JWT).\n// A backend service pulls stats for any user (secret key + user_id in body).\nexport default {\n fetch: withSupabase({ auth: ['user', 'secret'] }, async (req, ctx) => {\n const callerIsUser = ctx.authMode === 'user'\n\n if (callerIsUser) {\n // RLS-scoped — the database enforces \"own stats only\"\n const { data: myStats } = await ctx.supabase.from('play_stats').select()\n return Response.json(myStats)\n }\n\n // Service path — bypass RLS to pull stats for any user\n const { user_id } = await req.json()\n const { data: playStats } = await ctx.supabaseAdmin\n .from('play_stats')\n .select()\n .eq('user_id', user_id)\n return Response.json(playStats)\n }),\n}\n```" }, { "kind": "text", "text": "\n\n### Server-to-server\n\n" }, { "kind": "code", "text": "```ts\n// A cron job refreshes the \"popular this week\" list every hour.\n// Named key (\"cron\") so it can be rotated without touching other services.\nexport default {\n fetch: withSupabase({ auth: 'secret:cron' }, async (_req, ctx) => {\n const oneWeekAgo = new Date(Date.now() - 7 * 24 * 60 * 60 * 1000)\n const { data: popularThisWeek } = await ctx.supabaseAdmin.rpc(\n 'get_most_favorited_since',\n { since: oneWeekAgo.toISOString(), limit_count: 10 },\n )\n await ctx.supabaseAdmin\n .from('featured_games')\n .upsert(\n popularThisWeek.map((g) => ({ game_id: g.id, reason: 'popular' })),\n )\n return Response.json({ popularThisWeek })\n }),\n}\n```" }, { "kind": "text", "text": "\n\nThe cron job sends the named secret key in the " }, { "kind": "code", "text": "`apikey`" }, { "kind": "text", "text": " header:\n\n" }, { "kind": "code", "text": "```ts\nconst refreshEndpoint =\n 'https://.supabase.co/functions/v1/refresh-popular'\nconst cronKey = 'sb_secret_...' // the \"cron\" named secret key\n\nawait fetch(refreshEndpoint, {\n method: 'POST',\n headers: { apikey: cronKey },\n})\n```" }, { "kind": "text", "text": "\n\n## Auth Modes\n\n| Mode | Credential | Use case |\n| ------------------ | ------------------------------- | --------------------------------------------------- |\n| " }, { "kind": "code", "text": "`\"user\"`" }, { "kind": "text", "text": " (default) | Valid JWT | Authenticated user endpoints |\n| " }, { "kind": "code", "text": "`\"publishable\"`" }, { "kind": "text", "text": " | Valid " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " publishable key | Client-facing, key-validated endpoints |\n| " }, { "kind": "code", "text": "`\"secret\"`" }, { "kind": "text", "text": " | Valid " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " secret key | Server-to-server, internal calls |\n| " }, { "kind": "code", "text": "`\"none\"`" }, { "kind": "text", "text": " | None | Open endpoints, wrappers that handle their own auth |\n\nArray syntax (" }, { "kind": "code", "text": "`auth: [\"user\", \"secret\"]`" }, { "kind": "text", "text": ") accepts multiple auth methods — first match wins. An absent credential falls through to the next mode; a present-but-invalid JWT rejects the request (no silent downgrade).\n\nNamed key validation: " }, { "kind": "code", "text": "`auth: \"publishable:web_app\"`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`auth: \"secret:automations\"`" }, { "kind": "text", "text": " validates against a specific named key in " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": ". Bare " }, { "kind": "code", "text": "`auth: \"secret\"`" }, { "kind": "text", "text": " (or " }, { "kind": "code", "text": "`\"publishable\"`" }, { "kind": "text", "text": ") matches only the " }, { "kind": "code", "text": "`default`" }, { "kind": "text", "text": " key; use the wildcard " }, { "kind": "code", "text": "`auth: \"secret:*\"`" }, { "kind": "text", "text": " to accept any key in the set. See [" }, { "kind": "code", "text": "`docs/auth-modes.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/auth-modes.md", "target": 8 }, { "kind": "text", "text": ").\n\n> **Supabase Edge Functions:** By default, the platform requires a valid JWT on every request. If your function uses " }, { "kind": "code", "text": "`auth: 'publishable'`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`auth: 'secret'`" }, { "kind": "text", "text": ", or " }, { "kind": "code", "text": "`auth: 'none'`" }, { "kind": "text", "text": ", disable the platform-level JWT check in " }, { "kind": "code", "text": "`supabase/config.toml`" }, { "kind": "text", "text": ":\n>\n> " }, { "kind": "code", "text": "```toml\n> [functions.my-function]\n> verify_jwt = false\n> ```" }, { "kind": "text", "text": "\n\n## Context\n\nEvery handler receives a " }, { "kind": "code", "text": "`SupabaseContext`" }, { "kind": "text", "text": ":\n\n" }, { "kind": "code", "text": "```ts\ninterface SupabaseContext {\n supabase: SupabaseClient // RLS-scoped (user or anon depending on auth)\n supabaseAdmin: SupabaseClient // Bypasses RLS\n userClaims: UserClaims | null // JWT-derived identity (for full User, call supabase.auth.getUser())\n jwtClaims: JWTClaims | null // Present when auth is JWT\n authMode: AuthMode // Which auth mode matched\n authKeyName?: string // Auth key name of the API key that was used for this request (omitted for `'user'` / `'none'`)\n}\n```" }, { "kind": "text", "text": "\n\n" }, { "kind": "code", "text": "`supabase`" }, { "kind": "text", "text": " is always the safe client — it respects RLS. When " }, { "kind": "code", "text": "`authMode`" }, { "kind": "text", "text": " is " }, { "kind": "code", "text": "`\"user\"`" }, { "kind": "text", "text": ", it's scoped to that user's permissions. Otherwise, it's initialized as anonymous.\n\n" }, { "kind": "code", "text": "`supabaseAdmin`" }, { "kind": "text", "text": " always bypasses RLS. Use it for operations that need full database access.\n\n## Config\n\n" }, { "kind": "code", "text": "```ts\nwithSupabase(\n {\n auth: 'user', // who can call this function\n cors: 'disabled', // disable CORS (default: supabase-js CORS headers)\n env: { url: '...' }, // env overrides (optional)\n },\n handler,\n)\n```" }, { "kind": "text", "text": "\n\n" }, { "kind": "code", "text": "`cors`" }, { "kind": "text", "text": " accepts " }, { "kind": "code", "text": "`'default'`" }, { "kind": "text", "text": " (the standard [supabase-js CORS headers](https://supabase.com/docs/guides/functions/cors), also the default), " }, { "kind": "code", "text": "`'disabled'`" }, { "kind": "text", "text": " to disable CORS handling (e.g. when using a framework that handles CORS separately), or " }, { "kind": "code", "text": "`{ headers }`" }, { "kind": "text", "text": " to set custom headers. The boolean (" }, { "kind": "code", "text": "`true`" }, { "kind": "text", "text": "/" }, { "kind": "code", "text": "`false`" }, { "kind": "text", "text": ") and bare " }, { "kind": "code", "text": "`Record`" }, { "kind": "text", "text": " forms are deprecated but still accepted.\n\n" }, { "kind": "code", "text": "```ts\nwithSupabase(\n {\n auth: 'user',\n cors: {\n headers: {\n 'Access-Control-Allow-Origin': 'https://myapp.com',\n 'Access-Control-Allow-Headers': 'authorization, content-type',\n },\n },\n },\n handler,\n)\n```" }, { "kind": "text", "text": "\n\n" }, { "kind": "code", "text": "`env`" }, { "kind": "text", "text": " overrides environment variable resolution. Defaults to reading " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": ", and " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " from the runtime environment.\n\n## Framework Adapters\n\nAdapters wrap " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " for a specific framework's middleware contract. They ship inside " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": ", so a single " }, { "kind": "code", "text": "`npm install @supabase/server`" }, { "kind": "text", "text": " covers the framework you're using — no separate package per adapter.\n\n> **Adapters are a community-driven initiative.** They're developed, maintained, and evolved by contributors — including responding to upstream framework changes. See [" }, { "kind": "code", "text": "`src/adapters/README.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "src/adapters/README.md", "target": 17 }, { "kind": "text", "text": ") for the contribution requirements (tests, types, docs, build wiring) if you'd like to add or help maintain one.\n\n| Framework | Import | Framework version | Docs |\n| --------- | ---------------------------------- | ---------------------- | -------------------------------------------------- |\n| Hono | " }, { "kind": "code", "text": "`@supabase/server/adapters/hono`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`^4.0.0`" }, { "kind": "text", "text": " | [docs/adapters/hono.md](" }, { "kind": "relative-link", "text": "docs/adapters/hono.md", "target": 1 }, { "kind": "text", "text": ") |\n| H3 / Nuxt | " }, { "kind": "code", "text": "`@supabase/server/adapters/h3`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`^2.0.0`" }, { "kind": "text", "text": " | [docs/adapters/h3.md](" }, { "kind": "relative-link", "text": "docs/adapters/h3.md", "target": 18 }, { "kind": "text", "text": ") |\n| Elysia | " }, { "kind": "code", "text": "`@supabase/server/adapters/elysia`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`^1.4.0`" }, { "kind": "text", "text": " | [docs/adapters/elysia.md](" }, { "kind": "relative-link", "text": "docs/adapters/elysia.md", "target": 19 }, { "kind": "text", "text": ") |\n| NestJS | " }, { "kind": "code", "text": "`@supabase/server/adapters/nestjs`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`^10.0.0 \\|\\| ^11.0.0`" }, { "kind": "text", "text": " | [docs/adapters/nestjs.md](" }, { "kind": "relative-link", "text": "docs/adapters/nestjs.md", "target": 20 }, { "kind": "text", "text": ") |\n\nSee the per-adapter docs above for setup, per-route auth, CORS, error handling, and other patterns.\n\n### Elysia\n\n" }, { "kind": "code", "text": "```ts\nimport { Elysia } from 'elysia'\nimport { withSupabase } from '@supabase/server/adapters/elysia'\n\nconst app = new Elysia()\n // Protected — plugin resolves supabaseContext before handlers run\n .use(withSupabase({ auth: 'user' }))\n .get('/games', async ({ supabaseContext }) => {\n const { data: myGames } = await supabaseContext.supabase\n .from('favorite_games')\n .select()\n return myGames\n })\n // Public — no plugin means no auth\n .get('/health', () => ({ status: 'ok' }))\n\napp.listen(3000)\n```" }, { "kind": "text", "text": "\n\nFor per-route auth, use scoped groups:\n\n" }, { "kind": "code", "text": "```ts\nimport { Elysia } from 'elysia'\nimport { withSupabase } from '@supabase/server/adapters/elysia'\n\nconst app = new Elysia()\n .get('/health', () => ({ status: 'ok' }))\n .group('/api', (app) =>\n app\n .use(withSupabase({ auth: 'user' }))\n .get('/profile', async ({ supabaseContext }) => {\n return supabaseContext.userClaims\n }),\n )\n\napp.listen(3000)\n```" }, { "kind": "text", "text": "\n\nThe adapter does not handle CORS — use " }, { "kind": "code", "text": "`@elysiajs/cors`" }, { "kind": "text", "text": " for that.\n\n### NestJS\n\n" }, { "kind": "code", "text": "```ts\nimport { Controller, Get, UseGuards } from '@nestjs/common'\nimport { withSupabase, SupabaseCtx } from '@supabase/server/adapters/nestjs'\nimport type { SupabaseContext } from '@supabase/server'\n\n@Controller('games')\n@UseGuards(withSupabase({ auth: 'user' }))\nexport class GamesController {\n @Get()\n list(@SupabaseCtx() ctx: SupabaseContext) {\n return ctx.supabase.from('favorite_games').select()\n }\n}\n```" }, { "kind": "text", "text": "\n\nSee [docs/adapters/nestjs.md](" }, { "kind": "relative-link", "text": "docs/adapters/nestjs.md", "target": 20 }, { "kind": "text", "text": ") for per-route auth, exception filters, CORS, and more.\n\n## Primitives\n\nFor when you need more control than " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " provides — multiple routes with different auth, custom response headers, or building your own wrapper.\n\nAll primitives are available from " }, { "kind": "code", "text": "`@supabase/server/core`" }, { "kind": "text", "text": ".\n\n" }, { "kind": "code", "text": "```ts\nimport {\n verifyAuth,\n createContextClient,\n createAdminClient,\n} from '@supabase/server/core'\n```" }, { "kind": "text", "text": "\n\n### verifyAuth\n\nExtracts credentials from a Request and validates against the auth config.\n\n" }, { "kind": "code", "text": "```ts\nconst { data: auth, error } = await verifyAuth(req, { auth: 'user' })\nif (error) {\n return Response.json({ message: error.message }, { status: error.status })\n}\n```" }, { "kind": "text", "text": "\n\n### verifyCredentials\n\nLow-level — works with raw credentials instead of a Request. Used by SSR adapters and custom auth flows.\n\n" }, { "kind": "code", "text": "```ts\nconst credentials = { token: myToken, apikey: null }\nconst { data: result, error } = await verifyCredentials(credentials, {\n auth: 'user',\n})\n```" }, { "kind": "text", "text": "\n\n### createContextClient / createAdminClient\n\n" }, { "kind": "code", "text": "```ts\nconst userScopedClient = createContextClient(auth.token) // RLS applies as this user\nconst anonClient = createContextClient() // RLS applies as anon role\nconst adminClient = createAdminClient() // bypasses RLS entirely\n```" }, { "kind": "text", "text": "\n\n### createSupabaseContext\n\nFull context assembly from a Request — " }, { "kind": "code", "text": "`verifyAuth`" }, { "kind": "text", "text": " + client creation in one call.\n\n" }, { "kind": "code", "text": "```ts\nconst { data: ctx, error } = await createSupabaseContext(req, { auth: 'user' })\n```" }, { "kind": "text", "text": "\n\n### resolveEnv\n\nResolves environment variables with optional overrides.\n\n" }, { "kind": "code", "text": "```ts\nconst { data: env, error } = resolveEnv({\n url: process.env.NEXT_PUBLIC_SUPABASE_URL,\n})\n```" }, { "kind": "text", "text": "\n\n### Example: custom multi-route handler\n\nThe same games API and health check from the Hono example, built from primitives instead of a framework:\n\n" }, { "kind": "code", "text": "```ts\nimport { verifyAuth, createContextClient } from '@supabase/server/core'\n\nexport default {\n fetch: async (req) => {\n const url = new URL(req.url)\n\n // Public — no auth needed\n if (url.pathname === '/health') {\n return Response.json({ status: 'ok' })\n }\n\n // Protected — verify the JWT, then create a user-scoped client\n if (url.pathname === '/games') {\n const { data: result, error } = await verifyAuth(req, { auth: 'user' })\n if (error)\n return Response.json(\n { message: error.message },\n { status: error.status },\n )\n\n const userScopedClient = createContextClient(result.token)\n const { data: myGames } = await userScopedClient\n .from('favorite_games')\n .select()\n return Response.json(myGames)\n }\n\n return new Response('Not found', { status: 404 })\n },\n}\n```" }, { "kind": "text", "text": "\n\n## Environment Variables\n\nAutomatically available in Supabase Edge Functions:\n\n| Variable | Format | Description |\n| --------------------------- | ------------------------------------------------------------- | -------------------------------------------- |\n| " }, { "kind": "code", "text": "`SUPABASE_URL`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`https://.supabase.co`" }, { "kind": "text", "text": " | Your project URL |\n| " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEYS`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`{\"default\":\"sb_publishable_...\",\"web\":\"sb_publishable_...\"}`" }, { "kind": "text", "text": " | Publishable API keys (named) |\n| " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEYS`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`{\"default\":\"sb_secret_...\",\"web\":\"sb_secret_...\"}`" }, { "kind": "text", "text": " | Secret API keys (named) |\n| " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`{\"keys\":[...]}`" }, { "kind": "text", "text": " or " }, { "kind": "code", "text": "`[...]`" }, { "kind": "text", "text": " | Inline JSON Web Key Set for JWT verification |\n\nAlso supported (for local dev, self-hosted, or other runtimes):\n\n| Variable | Format | Description |\n| -------------------------- | -------------------- | --------------------------------------------------------- |\n| " }, { "kind": "code", "text": "`SUPABASE_PUBLISHABLE_KEY`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`sb_publishable_...`" }, { "kind": "text", "text": " | Single publishable key |\n| " }, { "kind": "code", "text": "`SUPABASE_SECRET_KEY`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`sb_secret_...`" }, { "kind": "text", "text": " | Single secret key |\n| " }, { "kind": "code", "text": "`SUPABASE_JWKS_URL`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`https://...`" }, { "kind": "text", "text": " | Remote JWKS endpoint (used when " }, { "kind": "code", "text": "`SUPABASE_JWKS`" }, { "kind": "text", "text": " is unset) |\n\nWhen both singular and plural forms are set, plural takes priority.\n\nFor other environments, pass overrides via the " }, { "kind": "code", "text": "`env`" }, { "kind": "text", "text": " config option or " }, { "kind": "code", "text": "`resolveEnv()`" }, { "kind": "text", "text": ". See [" }, { "kind": "code", "text": "`docs/environment-variables.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/environment-variables.md", "target": 3 }, { "kind": "text", "text": ") for details.\n\n## Runtimes\n\n" }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": " runs anywhere standard Web " }, { "kind": "code", "text": "`fetch`" }, { "kind": "text", "text": " does — pick the row that matches your deployment target.\n\n| Target | Notes |\n| --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |\n| **Supabase Edge Functions** | Zero config — environment variables are auto-injected. |\n| **Vercel Functions** | Edge runtime: " }, { "kind": "code", "text": "`export default { fetch }`" }, { "kind": "text", "text": ". Node runtime: use a [framework adapter](#framework-adapters) or [core primitives](#primitives). |\n| **Cloudflare Workers** | Enable " }, { "kind": "code", "text": "`nodejs_compat`" }, { "kind": "text", "text": " in " }, { "kind": "code", "text": "`wrangler.toml`" }, { "kind": "text", "text": ", or pass overrides via the " }, { "kind": "code", "text": "`env`" }, { "kind": "text", "text": " config option. |\n| **Deno / Bun** | Works out of the box via " }, { "kind": "code", "text": "`export default { fetch }`" }, { "kind": "text", "text": ". |\n| **Node.js** | Use a [framework adapter](#framework-adapters) or [core primitives](#primitives) with your framework of choice. |\n\nUsing a framework? See [Framework Adapters](#framework-adapters) for Hono, H3 / Nuxt, and Elysia, or [" }, { "kind": "code", "text": "`docs/ssr-frameworks.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/ssr-frameworks.md", "target": 5 }, { "kind": "text", "text": ") for Next.js / SvelteKit / Remix (compose with [" }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": "](https://github.com/supabase/ssr)).\n\n### Does this replace " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": "?\n\nNo. " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " handles cookie-based session management for frameworks like Next.js and SvelteKit. " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": " handles stateless, header-based auth for Edge Functions, Workers, and other backend runtimes. The composable primitives already work in SSR environments but require more setup — see [" }, { "kind": "code", "text": "`docs/ssr-frameworks.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/ssr-frameworks.md", "target": 5 }, { "kind": "text", "text": ") for the Next.js example. The two packages coexist and are not replacements for each other. Deeper integration with " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " is on the roadmap.\n\n## Exports\n\n| Export | What's in it |\n| ---------------------------------- | ----------------------------------------------------------------------------------------------------------------- |\n| " }, { "kind": "code", "text": "`@supabase/server`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`createSupabaseContext`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`@supabase/server/core`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`verifyAuth`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`verifyCredentials`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`extractCredentials`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`createContextClient`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`createAdminClient`" }, { "kind": "text", "text": ", " }, { "kind": "code", "text": "`resolveEnv`" }, { "kind": "text", "text": " |\n| " }, { "kind": "code", "text": "`@supabase/server/adapters/hono`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " (Hono middleware) |\n| " }, { "kind": "code", "text": "`@supabase/server/adapters/h3`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " (H3 / Nuxt middleware) |\n| " }, { "kind": "code", "text": "`@supabase/server/adapters/elysia`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " (Elysia plugin) |\n| " }, { "kind": "code", "text": "`@supabase/server/adapters/nestjs`" }, { "kind": "text", "text": " | " }, { "kind": "code", "text": "`withSupabase`" }, { "kind": "text", "text": " (NestJS guard), " }, { "kind": "code", "text": "`SupabaseCtx`" }, { "kind": "text", "text": " (param decorator) |\n\n## Documentation\n\n| Question | Doc file |\n| ------------------------------------------------------------------- | ---------------------------------------------------------------- |\n| How do I create a basic endpoint? | [" }, { "kind": "code", "text": "`docs/getting-started.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/getting-started.md", "target": 4 }, { "kind": "text", "text": ") |\n| What auth modes are available? Array syntax? Named keys? | [" }, { "kind": "code", "text": "`docs/auth-modes.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/auth-modes.md", "target": 8 }, { "kind": "text", "text": ") |\n| Which framework adapters exist? How do I contribute one? | [" }, { "kind": "code", "text": "`src/adapters/README.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "src/adapters/README.md", "target": 17 }, { "kind": "text", "text": ") |\n| How do I use this with Hono? | [" }, { "kind": "code", "text": "`docs/adapters/hono.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/adapters/hono.md", "target": 1 }, { "kind": "text", "text": ") |\n| How do I use this with H3 / Nuxt? | [" }, { "kind": "code", "text": "`docs/adapters/h3.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/adapters/h3.md", "target": 18 }, { "kind": "text", "text": ") |\n| How do I use this with Elysia? | [" }, { "kind": "code", "text": "`docs/adapters/elysia.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/adapters/elysia.md", "target": 19 }, { "kind": "text", "text": ") |\n| How do I use this with NestJS? | [" }, { "kind": "code", "text": "`docs/adapters/nestjs.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/adapters/nestjs.md", "target": 20 }, { "kind": "text", "text": ") |\n| How do I use low-level primitives for custom flows? | [" }, { "kind": "code", "text": "`docs/core-primitives.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/core-primitives.md", "target": 2 }, { "kind": "text", "text": ") |\n| How do environment variables work across runtimes? | [" }, { "kind": "code", "text": "`docs/environment-variables.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/environment-variables.md", "target": 3 }, { "kind": "text", "text": ") |\n| How do I handle errors? What codes exist? | [" }, { "kind": "code", "text": "`docs/error-handling.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/error-handling.md", "target": 9 }, { "kind": "text", "text": ") |\n| How do I get typed database queries? | [" }, { "kind": "code", "text": "`docs/typescript-generics.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/typescript-generics.md", "target": 10 }, { "kind": "text", "text": ") |\n| How do I use this with " }, { "kind": "code", "text": "`@supabase/ssr`" }, { "kind": "text", "text": " (Next.js, SvelteKit, Remix)? | [" }, { "kind": "code", "text": "`docs/ssr-frameworks.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/ssr-frameworks.md", "target": 5 }, { "kind": "text", "text": ") |\n| What's the complete API surface? | [" }, { "kind": "code", "text": "`docs/api-reference.md`" }, { "kind": "text", "text": "](" }, { "kind": "relative-link", "text": "docs/api-reference.md", "target": 6 }, { "kind": "text", "text": ") |\n\n## Development\n\n" }, { "kind": "code", "text": "```bash\npnpm install\npnpm dev\n```" }, { "kind": "text", "text": "\n\n## Contributing\n\nSee [CONTRIBUTING.md](" }, { "kind": "relative-link", "text": "CONTRIBUTING.md", "target": 21 }, { "kind": "text", "text": ") for development workflow, commit conventions, and release process.\n\n## License\n\nMIT" } ], "symbolIdMap": { "10": { "packageName": "@supabase/server", "packagePath": "src/index.ts", "qualifiedName": "" }, "11": { "packageName": "@supabase/server", "packagePath": "src/core/index.ts", "qualifiedName": "" }, "12": { "packageName": "@supabase/server", "packagePath": "src/adapters/hono/index.ts", "qualifiedName": "" }, "13": { "packageName": "@supabase/server", "packagePath": "src/adapters/h3/index.ts", "qualifiedName": "" }, "14": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/index.ts", "qualifiedName": "" }, "15": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "withSupabase" }, "16": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "withSupabase" }, "17": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "Database" }, "18": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "config" }, "19": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "handler" }, "20": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "__type" }, "21": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "__type" }, "22": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "req" }, "23": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "ctx" }, "24": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "__type" }, "25": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "__type" }, "26": { "packageName": "@supabase/server", "packagePath": "src/with-supabase.ts", "qualifiedName": "req" }, "27": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "createSupabaseContext" }, "28": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "createSupabaseContext" }, "29": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "Database" }, "30": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "request" }, "31": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "options" }, "32": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "__type" }, "33": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "__type.data" }, "34": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "__type.error" }, "35": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "__type" }, "36": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "__type.data" }, "37": { "packageName": "@supabase/server", "packagePath": "src/create-supabase-context.ts", "qualifiedName": "__type.error" }, "38": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "Allow" }, "39": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "AllowWithKey" }, "40": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "AuthMode" }, "41": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "AuthModeWithKey" }, "42": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "AuthResult" }, "43": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "AuthResult.authMode" }, "44": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "AuthResult.token" }, "45": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "AuthResult.userClaims" }, "46": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "AuthResult.jwtClaims" }, "47": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "AuthResult.keyName" }, "48": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "ClientAuth" }, "49": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "ClientAuth.token" }, "50": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "ClientAuth.keyName" }, "51": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "CreateAdminClientOptions" }, "52": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "CreateAdminClientOptions.auth" }, "53": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "CreateAdminClientOptions.env" }, "54": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "CreateAdminClientOptions.supabaseOptions" }, "55": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "CreateContextClientOptions" }, "56": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "CreateContextClientOptions.auth" }, "57": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "CreateContextClientOptions.env" }, "58": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "CreateContextClientOptions.supabaseOptions" }, "59": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "Credentials" }, "60": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "Credentials.token" }, "61": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "Credentials.apikey" }, "62": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims" }, "63": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims.sub" }, "64": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims.iss" }, "65": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims.aud" }, "66": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims.exp" }, "67": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims.iat" }, "68": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims.role" }, "69": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims.email" }, "70": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims.app_metadata" }, "71": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims.user_metadata" }, "72": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "JWTClaims.__index" }, "74": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseContext" }, "75": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseContext.Database" }, "76": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseContext.supabase" }, "77": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseContext.supabaseAdmin" }, "78": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseContext.userClaims" }, "79": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseContext.jwtClaims" }, "80": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseContext.authMode" }, "81": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseContext.authKeyName" }, "82": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseEnv" }, "83": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseEnv.url" }, "84": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseEnv.publishableKeys" }, "85": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseEnv.secretKeys" }, "86": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "SupabaseEnv.jwks" }, "87": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "UserClaims" }, "88": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "UserClaims.id" }, "89": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "UserClaims.role" }, "90": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "UserClaims.email" }, "91": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "UserClaims.appMetadata" }, "92": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "UserClaims.userMetadata" }, "93": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "WithSupabaseConfig" }, "94": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "WithSupabaseConfig.auth" }, "95": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "WithSupabaseConfig.allow" }, "96": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "WithSupabaseConfig.env" }, "97": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "WithSupabaseConfig.cors" }, "98": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "__type" }, "99": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "__type.headers" }, "100": { "packageName": "@supabase/server", "packagePath": "src/types.ts", "qualifiedName": "WithSupabaseConfig.supabaseOptions" }, "101": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "AuthError" }, "102": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "AuthError.__constructor" }, "103": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "AuthError" }, "104": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "message" }, "105": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "code" }, "106": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "status" }, "107": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "AuthError.status" }, "108": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "AuthError.code" }, "109": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "AuthGenericError" }, "110": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "CreateSupabaseClientError" }, "111": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "EnvError" }, "112": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "EnvError.__constructor" }, "113": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "EnvError" }, "114": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "message" }, "115": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "code" }, "116": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "EnvError.status" }, "117": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "EnvError.code" }, "118": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "EnvGenericError" }, "119": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "Errors" }, "120": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__object" }, "121": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__object.INVALID_CREDENTIALS" }, "122": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "123": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "124": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__object.CREATE_SUPABASE_CLIENT_ERROR" }, "125": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "126": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "127": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__object.MISSING_SUPABASE_URL" }, "128": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "129": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "130": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__object.MISSING_SECRET_KEY" }, "131": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "132": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "133": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "name" }, "134": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__object.MISSING_DEFAULT_SECRET_KEY" }, "135": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "136": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "137": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__object.MISSING_PUBLISHABLE_KEY" }, "138": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "139": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "140": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "name" }, "141": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__object.MISSING_DEFAULT_PUBLISHABLE_KEY" }, "142": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "143": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "__function" }, "144": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "InvalidCredentialsError" }, "145": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "MissingDefaultPublishableKeyError" }, "146": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "MissingDefaultSecretKeyError" }, "147": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "MissingPublishableKeyError" }, "148": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "MissingSecretKeyError" }, "149": { "packageName": "@supabase/server", "packagePath": "src/errors.ts", "qualifiedName": "MissingSupabaseURLError" }, "150": { "packageName": "@supabase/server", "packagePath": "src/core/resolve-env.ts", "qualifiedName": "resolveEnv" }, "151": { "packageName": "@supabase/server", "packagePath": "src/core/resolve-env.ts", "qualifiedName": "resolveEnv" }, "152": { "packageName": "@supabase/server", "packagePath": "src/core/resolve-env.ts", "qualifiedName": "overrides" }, "153": { "packageName": "@supabase/server", "packagePath": "src/core/resolve-env.ts", "qualifiedName": "__type" }, "154": { "packageName": "@supabase/server", "packagePath": "src/core/resolve-env.ts", "qualifiedName": "__type.data" }, "155": { "packageName": "@supabase/server", "packagePath": "src/core/resolve-env.ts", "qualifiedName": "__type.error" }, "156": { "packageName": "@supabase/server", "packagePath": "src/core/resolve-env.ts", "qualifiedName": "__type" }, "157": { "packageName": "@supabase/server", "packagePath": "src/core/resolve-env.ts", "qualifiedName": "__type.data" }, "158": { "packageName": "@supabase/server", "packagePath": "src/core/resolve-env.ts", "qualifiedName": "__type.error" }, "159": { "packageName": "@supabase/server", "packagePath": "src/core/extract-credentials.ts", "qualifiedName": "extractCredentials" }, "160": { "packageName": "@supabase/server", "packagePath": "src/core/extract-credentials.ts", "qualifiedName": "extractCredentials" }, "161": { "packageName": "@supabase/server", "packagePath": "src/core/extract-credentials.ts", "qualifiedName": "request" }, "162": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "verifyCredentials" }, "163": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "verifyCredentials" }, "164": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "credentials" }, "165": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "options" }, "166": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "__type" }, "167": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "__type.data" }, "168": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "__type.error" }, "169": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "__type" }, "170": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "__type.data" }, "171": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "__type.error" }, "172": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "VerifyCredentialsOptions" }, "173": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "VerifyCredentialsOptions.auth" }, "174": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "VerifyCredentialsOptions.allow" }, "175": { "packageName": "@supabase/server", "packagePath": "src/core/verify-credentials.ts", "qualifiedName": "VerifyCredentialsOptions.env" }, "176": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "verifyAuth" }, "177": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "verifyAuth" }, "178": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "request" }, "179": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "options" }, "180": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "__type" }, "181": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "__type.data" }, "182": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "__type.error" }, "183": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "__type" }, "184": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "__type.data" }, "185": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "__type.error" }, "186": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "VerifyAuthOptions" }, "187": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "VerifyAuthOptions.auth" }, "188": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "VerifyAuthOptions.allow" }, "189": { "packageName": "@supabase/server", "packagePath": "src/core/verify-auth.ts", "qualifiedName": "VerifyAuthOptions.env" }, "190": { "packageName": "@supabase/server", "packagePath": "src/core/create-context-client.ts", "qualifiedName": "createContextClient" }, "191": { "packageName": "@supabase/server", "packagePath": "src/core/create-context-client.ts", "qualifiedName": "createContextClient" }, "192": { "packageName": "@supabase/server", "packagePath": "src/core/create-context-client.ts", "qualifiedName": "Database" }, "193": { "packageName": "@supabase/server", "packagePath": "src/core/create-context-client.ts", "qualifiedName": "options" }, "194": { "packageName": "@supabase/server", "packagePath": "src/core/create-admin-client.ts", "qualifiedName": "createAdminClient" }, "195": { "packageName": "@supabase/server", "packagePath": "src/core/create-admin-client.ts", "qualifiedName": "createAdminClient" }, "196": { "packageName": "@supabase/server", "packagePath": "src/core/create-admin-client.ts", "qualifiedName": "Database" }, "197": { "packageName": "@supabase/server", "packagePath": "src/core/create-admin-client.ts", "qualifiedName": "options" }, "198": { "packageName": "@supabase/server", "packagePath": "src/core/index.ts", "qualifiedName": "ClientAuth" }, "199": { "packageName": "@supabase/server", "packagePath": "src/core/index.ts", "qualifiedName": "CreateAdminClientOptions" }, "200": { "packageName": "@supabase/server", "packagePath": "src/core/index.ts", "qualifiedName": "CreateContextClientOptions" }, "201": { "packageName": "@supabase/server", "packagePath": "src/adapters/hono/middleware.ts", "qualifiedName": "withSupabase" }, "202": { "packageName": "@supabase/server", "packagePath": "src/adapters/hono/middleware.ts", "qualifiedName": "withSupabase" }, "203": { "packageName": "@supabase/server", "packagePath": "src/adapters/hono/middleware.ts", "qualifiedName": "config" }, "204": { "packageName": "@supabase/server", "packagePath": "src/adapters/hono/middleware.ts", "qualifiedName": "__type" }, "205": { "packageName": "@supabase/server", "packagePath": "src/adapters/hono/middleware.ts", "qualifiedName": "__type.Variables" }, "206": { "packageName": "@supabase/server", "packagePath": "src/adapters/hono/middleware.ts", "qualifiedName": "__type" }, "207": { "packageName": "@supabase/server", "packagePath": "src/adapters/hono/middleware.ts", "qualifiedName": "__type.supabaseContext" }, "208": { "packageName": "@supabase/server", "packagePath": "src/adapters/h3/middleware.ts", "qualifiedName": "withSupabase" }, "209": { "packageName": "@supabase/server", "packagePath": "src/adapters/h3/middleware.ts", "qualifiedName": "withSupabase" }, "210": { "packageName": "@supabase/server", "packagePath": "src/adapters/h3/middleware.ts", "qualifiedName": "config" }, "211": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "SupabaseError" }, "212": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "SupabaseError.__constructor" }, "213": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "SupabaseError" }, "214": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "inner" }, "215": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "SupabaseError.status" }, "216": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "SupabaseError.cause" }, "217": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "withSupabase" }, "218": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "withSupabase" }, "219": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "config" }, "220": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type" }, "221": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.decorator" }, "222": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "223": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.store" }, "224": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "225": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.derive" }, "226": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "227": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.resolve" }, "228": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "229": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type" }, "230": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.typebox" }, "231": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "232": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.error" }, "233": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type" }, "234": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.SupabaseError" }, "235": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type" }, "236": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.schema" }, "237": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "238": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.standaloneSchema" }, "239": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "240": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.macro" }, "241": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "242": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.macroFn" }, "243": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "244": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.parser" }, "245": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "246": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.response" }, "247": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "248": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "249": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type" }, "250": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.derive" }, "251": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "252": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.resolve" }, "253": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type" }, "254": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.supabaseContext" }, "255": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.schema" }, "256": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "257": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.standaloneSchema" }, "258": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "259": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.response" }, "260": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type" }, "261": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.supabaseContext" }, "262": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type" }, "263": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.derive" }, "264": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "265": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.resolve" }, "266": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "267": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.schema" }, "268": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "269": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.standaloneSchema" }, "270": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" }, "271": { "packageName": "@supabase/server", "packagePath": "src/adapters/elysia/plugin.ts", "qualifiedName": "__type.response" }, "272": { "packageName": "@supabase/server", "packagePath": "", "qualifiedName": "__type" } }, "files": { "entries": { "1": "docs/adapters/hono.md", "2": "docs/core-primitives.md", "3": "docs/environment-variables.md", "4": "docs/getting-started.md", "5": "docs/ssr-frameworks.md", "6": "docs/api-reference.md", "7": "docs/security.md", "8": "docs/auth-modes.md", "9": "docs/error-handling.md", "10": "docs/typescript-generics.md", "11": "src/index.ts", "12": "src/core/index.ts", "13": "src/adapters/hono/index.ts", "14": "src/adapters/h3/index.ts", "15": "src/adapters/elysia/index.ts", "16": "MIGRATION.md", "17": "src/adapters/README.md", "18": "docs/adapters/h3.md", "19": "docs/adapters/elysia.md", "20": "docs/adapters/nestjs.md", "21": "CONTRIBUTING.md", "22": "README.md", "23": "" }, "reflections": { "2": 2, "3": 5, "4": 1, "5": 8, "6": 3, "7": 7, "8": 4, "9": 6, "10": 9, "11": 10, "12": 11, "13": 12, "14": 13, "15": 14, "22": 0, "23": 0 } } }