1. Habit
  2. Skills
  3. Supabase Server skill
supabase · 10K installs

Supabase Server skill
Runs by itself, edge function changes.

Edge Function auth stays correct.

Install the Supabase Server skill and make it a habit: follow https://gethabit.dev/skills/supabase/supabase-server.md

  1. 1Copy
  2. 2Paste into Claude Code, Codex or Cursor
  3. 3It runs by itself

10K installs94 starsMIT licenceSource on GitHub ↗

Supabase Server

by supabase · 10K installs

The skill

The Supabase Server skill (supabase-server) guides an agent writing server-side code with @supabase/server: Edge Functions and backend handlers that pick an auth mode, create Supabase clients and verify inbound auth, and migrate legacy patterns.

Only when you ask.

The habit

Edge Function auth stays correct.

↻ Runs by itselfedge function changes

How the habit works.
You don't have to.

Three questionsWhen does it start? How does it check its work? What does it remember?

01

It starts by itself

edge function changes. Runs in GitHub Actions or Claude Code routine.

  • ↻ edge function changes
  • pull_request paths: supabase/functions/**

02

It checks its work

build and auth-mode checks. If a check fails, it tells you.

  • ✓build passes
  • ✓every handler sets an auth mode of user, publishable, secret or none
  • ✓no legacy 'always' or 'public' mode or SUPABASE_ANON_KEY / SUPABASE_SERVICE_ROLE_KEY remains
  • ✓functions using publishable, secret or none set verify_jwt false in config.toml

03

It remembers

auth review log. The next run reads it first: auth findings from earlier pull requests.

loops/supabase-server-auth-review-loop/log.md

One run, step by step.
Then it stops.

Stop ruleStops after one pull request per run and at most 1 build retry.

  1. 01

    List changes

    Collect the changed files under supabase/functions and any config.toml edits.

  2. 02

    Check auth mode

    Confirm each handler states an auth mode and does not fall back to a neighbour's value.

  3. 03

    Check verify_jwt

    Confirm config.toml sets verify_jwt false for publishable, secret or none handlers.

  4. 04

    Check keys

    Flag legacy keys and legacy mode values and the renamed authType field.

  5. 05

    Check public endpoints

    Confirm auth none handlers verify a webhook signature or are truly public.

  6. 06

    Build and log

    Run the build, comment the findings and add them to the log.

What it may do.
Nothing more.

Safe by defaultIt writes only in its own folder and asks you before anything goes out.

Is it for you?
Use it when it fits.

Quick checkRead both lists. If the left one sounds like you, the Supabase Server skill helps.

Use it when

  • ✓ You write a Supabase Edge Function
  • ✓ You pick an auth mode for a handler
  • ✓ You migrate legacy Deno.serve code

Skip it when

  • – You write only client-side Supabase code
  • – You do first-time project setup

Questions

Supabase Server skill, answered.

Does it rewrite my functions?

No. It comments findings; you decide what to change.

Why flag auth none?

It turns off all credential checks, so the skill asks you to confirm the endpoint is truly public.

How do I install the Supabase Server skill?

Copy the prompt at the top into your agent. It installs the skill from supabase/server and sets up the habit. Or run npx skills add supabase/server --skill supabase-server.

Is the Supabase Server skill free?

Yes. It is published under MIT. Habit is free too.

Supabase Server. Now as a habit.

Install the Supabase Server skill and make it a habit: follow https://gethabit.dev/skills/supabase/supabase-server.md

  • Free
  • No account
  • Undo in one line

All supabase skills →More code skills →

Works in

  • Claude Code
  • Codex
  • Cursor
  • ChatGPT
  • Claude app

Made by supabase, published under MIT. Habit links to the original and never changes it. Is this your skill?

Copying didn't work here. Select the line and copy it by hand.