IntegrationsTutorial

Supabase

Auth, database, project alignment, and fulfillment readiness.

Integration

Supabase

Confirms auth and database access are ready before customers sign up.

Supabase is the auth and database backbone for many launch stacks. A Supabase failure usually means signups break, sessions fail, or paid users never get their entitlement written. PreFlight verifies project alignment, admin access, and auth endpoints before you open registration.

Requirements

The service role key bypasses Row Level Security. Store it in server-only environment variables. If it ever appears in a client bundle, PreFlight's secret-leak scan will flag it—and you should rotate it immediately.

What PreFlight checks

| Probe | What it proves | | --- | --- | | Project + key match | The project URL and keys belong to the same working Supabase project. | | Admin auth | A temporary user can be created and cleaned up, proving admin access works. | | Auth endpoints | The auth API answers correctly for the configured providers. | | RLS audit | Row Level Security is enabled on sensitive tables before launch. | | Database Change Check | Application schema expectations align with the live database. | | Shadow correlation | Project health and webhook flows can be correlated against stored rows when shadow checks are enabled. |

Failure guidance

| Symptom | Fix | | --- | --- | | Invalid service role key | Copy the server-side key from the correct Supabase project (Settings → API). | | Auth creation failure | Confirm the project URL and service role key belong to the same environment. | | Redirect URL mismatch | Verify redirect URLs in Supabase Auth settings match your deployed domain. | | Shadow verification failure | Confirm the target table and trace column exist in your application schema. | | RLS violation flagged | Enable RLS on the flagged table and add a restrictive policy. |

Dashboard setup

Open Connections and click Connect Supabase. Approve the Supabase Management API authorization, then choose which Supabase project belongs to this PreFlight app. PreFlight fetches that project's API keys server-side and encrypts the selected connection. You can disconnect the authorization at any time. Confirm redirect URLs in Supabase Auth include your production domain. Run Pre-Flight Check and review auth, admin, and RLS probe results. If OAuth is not configured for your workspace, import `.env`, `.env.local`, or a pasted environment block. Parsing happens in the browser, values are size-limited, and you choose the recognized variables before they are encrypted and saved.