No cap on LLM API spend in Supabase
criticalUpdated Oct 12, 2026
A usage table with RLS so users can read their own count and cannot update it is a reasonable store. The server, using a checked session, writes the count.
Fix for Supabase
A usage table with RLS so users can read their own count and cannot update it is a reasonable store. The server, using a checked session, writes the count. Do not let the client POST { used: 0 }.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Supabase fixes are on the Supabase page.