Server Actions with no auth check in Supabase
criticalUpdated Oct 12, 2026
Inside the action, create the client from the user's cookies so RLS runs, or use the secret key only after the session check and add user id to the query yourself. Do not create a module-level secret client and call it from every action by habit.
Fix for Supabase
Inside the action, create the client from the user's cookies so RLS runs, or use the secret key only after the session check and add user_id to the query yourself. Do not create a module-level secret client and call it from every action by habit.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.