skills.rest
nimdvir
nimdvirCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

supabase-server

Implements server-side Supabase auth, client creation, and context injection for Edge Functions and Hono apps.

1|Updated May 26, 2026
Search Tags:#authentication#supabase#edge functions#api keys#deno#server-side#hono
One-click install
npx skills add https://github.com/nimdvir/dima-publishing --skill supabase-server-nimdvir
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: supabase-server
Source: https://github.com/nimdvir/dima-publishing/tree/main/.agents/skills/supabase-server
Command: npx skills add https://github.com/nimdvir/dima-publishing --skill supabase-server-nimdvir

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires @supabase/server, @supabase/ssr, hono, stripe.

What problem does it solve? Writing server-side Supabase code traditionally requires manual client creation, auth header forwarding, CORS handling, and direct use of legacy anon/service_role keys. This Skill guides AI agents to write correct server-side code with the @supabase/server package, which handles credential verification, client creation, and context injection automatically. ## Core Features & Use Cases - Auth mode configuration: Guides correct use of the four auth modes (user, publishable, secret, none), including array syntax, named keys like secret:automations, and when to disable verify_jwt in supabase/config.toml. - Framework integration: Provides patterns for Supabase Edge Functions (Deno), Cloudflare Workers, Hono apps, and composition with @supabase/ssr for Next.js, SvelteKit, and Remix. - Legacy migration: Detects and migrates deprecated patterns such as Deno.serve, esm.sh imports, SUPABASE_ANON_KEY/SUPABASE_SERVICE_ROLE_KEY, the old allow: config, and removed 'always'/'public' mode values. - Use Case: When asked to build a Stripe webhook Edge Function, the Skill directs the agent to use auth: 'none' with signature verification, disable verify_jwt, and use ctx.supabaseAdmin for database writes. ## Quick Start Ask the AI to write a Supabase Edge Function that uses @supabase/server with user authentication to read rows from a todos table.

Frequently Asked Questions about supabase-server

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I create a Supabase Edge Function with authentication?▼

Use withSupabase from @supabase/server with an auth mode such as 'user' to wrap your fetch handler. The wrapper verifies credentials, handles CORS, and injects a pre-configured Supabase client into the context, so you only write business logic.

What auth modes does @supabase/server support?▼

The package supports four auth modes: 'user' for JWT verification, 'publishable' for publishable keys, 'secret' for secret keys, and 'none' for no credential checks. Array syntax like ['user', 'secret'] is first-match-wins, and named keys use syntax like 'secret:automations'.

Why is my Supabase Edge Function rejecting requests before reaching my handler?▼

Supabase Edge Functions require a valid JWT by default at the platform level. If your function uses auth 'publishable', 'secret', or 'none', set verify_jwt = false for that function in supabase/config.toml so requests reach your handler.

Can I use @supabase/server with Next.js or SvelteKit?▼

Yes, compose it with @supabase/ssr rather than replacing it. @supabase/ssr manages cookies and refresh-token rotation via middleware, then you pass the access token to verifyCredentials from @supabase/server/core and build clients with createContextClient and createAdminClient.

How do I migrate Edge Functions using SUPABASE_ANON_KEY or SUPABASE_SERVICE_ROLE_KEY?▼

Replace SUPABASE_ANON_KEY with manual auth forwarding using auth: 'user', or auth: 'publishable' when no auth is needed. Replace SUPABASE_SERVICE_ROLE_KEY with auth: 'secret' for endpoint protection, or use ctx.supabaseAdmin which is available regardless of auth mode.

When should I use auth 'none' in a Supabase function?▼

Use auth 'none' only for genuinely public endpoints like health checks, or for webhooks from external providers like Stripe where you verify the provider's signature inside the handler. Never use it for endpoints that read or write user data without verifying the caller.

Related Skills

Explore More Software Engineering Skills→
cwinvestmentscwinvestments
412

memstack-security-rls-checker

Audit Supabase Row Level Security policies across all tables.

Community
Intermediate
ethereumdegenethereumdegen
47

supabase_cli

Manage Supabase projects, databases, migrations, and edge functions via CLI.

Community
Advanced
dudqks0319-cpududqks0319-cpu

database-schema

Enforces reading database schema files before writing queries to prevent column and type errors.

Community
Intermediate
donPuertodonPuerto

supabase-server

Automate Supabase server-side authentication and client creation.

Community
Advanced