Supabase (Next.js)

type

lib

files

4

registry deps

none

npm deps

@supabase/ssr, @supabase/supabase-js

env vars

NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY, SUPABASE_SERVICE_ROLE_KEY

• ①Browser, server and interceptor clients from the official starter shape; getUser() revalidates, never trusts the cookie
• ②Nothing gated by default — pass { matcher, redirectTo } to updateSession to protect paths; /api/health is never gated
• ③createServiceClient() throws in a browser and is documented as RLS-bypassing server-only code

Set NEXT_PUBLIC_SUPABASE_URL and NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY everywhere; add SUPABASE_SERVICE_ROLE_KEY only where trusted server code calls createServiceClient() — it bypasses RLS and must never sit behind a route that trusts client input. createClient() from lib/supabase/client.ts in Client Components; the async createClient() from lib/supabase/server.ts in Server Components, Route Handlers and Server Actions. The install writes proxy.ts at the project root (Next 16's request interceptor — the file formerly called middleware.ts) which refreshes the auth session on every request via updateSession(request). Nothing is gated by default: pass updateSession(request, { matcher, redirectTo }) to protect paths (redirectTo defaults to /login, next= is preserved, /api/health is never gated). A missing env var throws naming the var, never its value.