Permission

Detailed Explanation

Permissions control what a user is allowed to do in your app. Can they read all posts? Can they edit only their own? Can they delete anything? Permissions answer these questions.

In Supabase, permissions are enforced through Row Level Security and RLS Policies. Each policy grants a specific permission:

• SELECT permission → User can read/view data
• INSERT permission → User can create new records
• UPDATE permission → User can edit existing records
• DELETE permission → User can remove records

Permissions are usually tied to Authentication:

• auth.uid() = user_id → "You can only access your own data"
• auth.role() = 'authenticated' → "Any logged-in user can do this"
• true → "Anyone can do this, even anonymous users"

Permission errors and debugging:

When permissions block an operation, you'll see specific status codes:

• 401 Unauthorized → No auth token (user isn't logged in)
• 403 Forbidden → Auth token exists but permission denied (wrong RLS policy)
• 200 OK with empty data → RLS silently blocked a SELECT query

The Network Tab is your best tool for diagnosing permission issues. Check the response body for error messages, and check the request headers for the Authorization token.

Related: Row Level Security, RLS Policy, Authentication, Token, Status Code, Network Tab, HTTP Response, HTTP Header

Permissions are enforced through Authorization — the process of checking what a user is allowed to do after they've been authenticated.