supabase-server

Guidance for planning and writing server-side code with the supabase/server package, the utilities that handle auth, Supabase client creation, and context injection for Edge Functions, Hono apps, webhook handlers, and other backends so developers write business logic instead of boilerplate. The skill is meant to be loaded before writing or modifying any file that imports from supabase/server or its sub-paths, calls functions like withSupabase, createSupabaseContext, createAdminClient, createContextClient, verifyAuth, verifyCredentials, or extractCredentials, or configures an auth mode, and also during planning, so auth values are never extrapolated from neighboring code. A central theme is correct, current configuration for this v1.0 public-beta package, which has no usage examples online yet. The config option is auth (not the deprecated allow, which still works with a one-time warning). The four valid auth modes are user (JWT), publishable (publishable key), secret (secret key), and none (no credentials); the legacy always and public values were removed and must be migrated to none and publishable, while the runtime field authType was renamed to authMode. Array syntax such as auth: ['user', 'secret'] is first-match-wins, and a present-but-invalid JWT rejects with InvalidCredentialsError rather than silently downgrading. Legacy Supabase keys are discouraged: the anon key maps to the new publishable keys and the service role key to secret keys, with direct createClient calls replaced by the package's auth modes. Three entry points are provided: the high-level supabase/server, a core module exposing primitives like verifyAuth and createAdminClient, and a Hono adapter for per-route auth. Quick starts cover Supabase Edge Functions on Deno, where non-user auth modes require disabling the platform verify_jwt in config.toml and imports must use the npm specifier, as well as Cloudflare Workers (needing nodejs_compat) and Hono (where CORS uses hono/cors). Use it to build or migrate authenticated Supabase backends onto the current, supported API.