Supabase Setup Guide
Free
Connect a practice app to a database with clear access boundaries.
BEGINNER / HOSTED BACKEND
1. Set the stage
Start with a separate practice project. You need a Supabase account and a small app; local Docker and the CLI are optional at this stage.
1. Create a practice project
At supabase.com/dashboard, create a project for learning. Keep its database password private and label the environment clearly.
2. Get the connection values
Use Connect for your framework URL and publishable key. Settings > API Keys lists the project keys. A URL and a key are different values.
3. Protect the data
Create a small test table and enable Row Level Security. Define who may read or write before connecting browser code.
4. Connect & verify
Use the framework quickstart and supabase-js. Test allowed and refused access with the publishable client; keep secret keys server-only.
2. Lean working stack
| Stage | Role | | --- | --- | | App UI | Collect input | | Supabase | Store under RLS | | Server route | Privileged work | | Tests | Check access |
Arrows in the visual sheet show the order of work. External connections require separate setup. Optional tools may be replaced with ones you already use. This is a suggested stack for this task, not a universal optimum.
Separate browser from server
The publishable key can reach the browser. Secret keys bypass normal RLS protections and must stay in trusted backend configuration.
Keep environments distinct
Use separate test data and environment variables. Add Auth or Storage only when the app needs them; never test by disabling access controls.
3. First practice task
Build a practice notes table with owner-based access. Confirm one signed-in test user can read their own note and cannot read another test user's note. Use synthetic content only.
Your setup is working when
The intended read succeeds, an unauthorized read fails, and no secret key appears in browser code, source control, or client logs.
Troubleshooting
Denied request? Check the session and RLS policy. Wrong project? Check the URL. Missing setting? Verify variable names and rebuild as needed.
Series 06 / 40