Lovable apps, RLS, keys, and auth in Supabase
criticalUpdated Oct 14, 2026
Enable RLS and add policies for anon and authenticated . Supabase's API key guide says policies never apply to a secret key, because service role has BYPASSRLS .
Fix for Supabase
Enable RLS and add policies for anon and authenticated. Supabase's API key guide says policies never apply to a secret key, because service_role has BYPASSRLS. Keep that key in the Edge Function environment Lovable already populates. Do not prefix it with VITE_.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.