Supabase Basics Cheat Sheet

# Install the Supabase CLInpm install -g supabase# Log in and link a local project to your Supabase projectsupabase loginsupabase initsupabase link --project-ref <your-project-ref># Start the local dev stack (Postgres, Studio, Auth, Storage) in Dockersupabase start# Generate a migration from schema changes and push itsupabase db diff -f add_orders_tablesupabase db push

-- Create a tablecreate table public.orders (  id uuid primary key default gen_random_uuid(),  user_id uuid references auth.users not null,  amount numeric not null,  created_at timestamptz default now());-- RLS must be enabled before any policy takes effectalter table public.orders enable row level security;-- Users can only see their own orderscreate policy "Users can view their own orders"  on public.orders for select  using (auth.uid() = user_id);-- Users can only insert orders for themselvescreate policy "Users can insert their own orders"  on public.orders for insert  with check (auth.uid() = user_id);

import { createClient } from '@supabase/supabase-js'const supabase = createClient(  process.env.SUPABASE_URL,  process.env.SUPABASE_ANON_KEY)// Sign in a userconst { data: authData, error: authError } =  await supabase.auth.signInWithPassword({ email, password })// Query data (RLS policies apply automatically for the logged-in user)const { data, error } = await supabase  .from('orders')  .select('id, amount, created_at')  .order('created_at', { ascending: false })  .limit(10)// Insert a rowawait supabase.from('orders').insert({ amount: 49.99 })// Subscribe to realtime changessupabase  .channel('orders-changes')  .on('postgres_changes', { event: 'INSERT', schema: 'public', table: 'orders' },    (payload) => console.log('New order:', payload.new))  .subscribe()

-- A function that needs to write across users (e.g. incrementing a shared counter)-- runs with the privileges of its owner, not the calling role.create or replace function public.increment_order_count(p_product_id uuid)returns voidlanguage plpgsqlsecurity definerset search_path = public  -- always pin search_path on SECURITY DEFINER functionsas $$begin  update public.products  set order_count = order_count + 1  where id = p_product_id;end;$$;-- Only let authenticated users call it, not raw SQL execute grantsrevoke all on function public.increment_order_count(uuid) from public;grant execute on function public.increment_order_count(uuid) to authenticated;

-- auth.jwt() exposes the full decoded access token as jsonbcreate policy "Org members can read org rows"  on public.documents for select  using (    (auth.jwt() -> 'app_metadata' ->> 'org_id')::uuid = org_id  );-- Combine role claim + ownership for admin overridecreate policy "Admins bypass ownership check"  on public.documents for select  using (    auth.jwt() ->> 'role' = 'service_role'    or auth.uid() = owner_id  );-- Set app_metadata (not user-editable) from a trusted server context, e.g. an Edge Function-- using the service role key:-- await supabaseAdmin.auth.admin.updateUserById(userId, { app_metadata: { org_id } })

supabase functions new send-receipt# Edit supabase/functions/send-receipt/index.ts, then set a secret it needssupabase secrets set STRIPE_SECRET_KEY=sk_live_xxx# Serve locally against your local stack for testingsupabase functions serve send-receipt --env-file ./supabase/.env.local# Deploy to production, optionally without JWT verification for public webhookssupabase functions deploy send-receipt --no-verify-jwt# Invoke it directly to sanity-checkcurl -i --location --request POST \  'https://<project-ref>.functions.supabase.co/send-receipt' \  --header 'Authorization: Bearer <anon-or-user-jwt>' \  --header 'Content-Type: application/json' \  --data '{"orderId":"123"}'

-- Trigger function that stamps updated_at on every UPDATEcreate or replace function public.set_updated_at()returns trigger language plpgsql as $$begin  new.updated_at = now();  return new;end;$$;create trigger orders_set_updated_at  before update on public.orders  for each row execute function public.set_updated_at();-- Database Webhooks (Studio -> Database -> Webhooks) are built on pg_net and-- fire an async HTTP POST to an Edge Function or external URL on insert/update/delete,-- letting you react to writes without polling from the client.