Connect Supabase

≈ 3 min Extension Bearer Token

Before you start

• A Supabase project, with Row Level Security (RLS) policies for the tables you use.
• The AWFlow browser extension. These steps run in the extension (the web app hands them to it).

Used by

• Supabase

Set it up

This is the only method AWFlow accepts. The secret service_role key is refused because it bypasses RLS.

1. Copy the key. In Supabase, open Project Settings › API and copy the key labelled anon public. Also note the Project URL (https://<project>.supabase.co).

2. Save it in AWFlow. Open Credentials and click Add Credential (or + Add Credential in a node’s Credential field), then fill the New Credential form. In the browser side panel the form comes in two steps: tap Supabase in the list, then fill the rest.

   12345

   1. 1 Step 1:Pick Supabase Under Integration App / Service, pick Supabase. There is no Auth Type menu: Supabase uses a Bearer Token.
   2. 2 Step 2:Name it For example Supabase – prices project. A Description is optional.
   3. 3 Step 3:Paste the anon key Paste the anon key into Bearer Token.
   4. 4 Step 4:Check where it is saved Signed in, choose Local (this browser only) or Cloud (synced to your account) under Storage location. Without an account it is saved locally in this browser, as here.
   5. 5 Step 5:Click Create Credential Check: the credential is listed on the Credentials page, ready to pick in nodes.

   Numbered areas in the screenshot: 1. Integration App / Service: Supabase; 2. Name; 3. Bearer Token; 4. Where the secret is stored (here, locally in this browser); 5. Create Credential.

3. Allow the access with RLS policies on each table, for example a policy that lets the anon role insert into prices.

4. In the node, pick the credential and paste the Project URL.

Check it's connected — 

Run Select rows on a table with a select policy: rows come back.

Where your token lives

Where your token lives — 

The credential is stored where you choose when you create it:

• Local (this browser only): encrypted in this browser. The encryption key is kept on the same device, so turn on the local secret vault to lock it with a passphrase only you know.
• Cloud (synced to your account): sent over an encrypted connection and stored encrypted on AWFlow’s server, so it works on your other devices.

When a step runs, your browser sends it only to your project URL (<project>.supabase.co). AWFlow’s servers never relay the call.

Privacy & your data →

Common issues

• “This is a Supabase service_role key, which bypasses Row Level Security…”. Replace it with the anon key.
• “401 … the request was blocked” (or 403). No RLS policy allows this operation for anon. Add one on the table.
• Select returns an empty list. RLS hides the rows from anon, or the filter matches nothing (use eq.42, not 42).
• The run is blocked in the web app. Supabase runs through the browser extension. Install the extension and allow Supabase for this workflow when asked, or run the workflow from the extension. See Extension-only integrations in the web app.

Related

Supabase node

All connections

Create and manage credentials

Privacy & your data