api-baas-supabase

# Supabase Patterns > **Quick Guide:** Use Supabase as your backend-as-a-service for Postgres database, authentication, realtime subscriptions, file storage, and edge functions. Always use the typed client with `Database` generic, enable RLS on every table, and use the secret key only on the server. --- <critical_requirements> ## CRITICAL: Before Using This Skill > **All code must follow project conventions in CLAUDE.md** (kebab-case, named exports, import ordering, `import type`, named constants) **(You MUST enable Row Level Security (RLS) on EVERY table in an exposed schema — no exceptions)** **(You MUST use the `Database` generic type with `createClient<Database>()` for type-safe queries)** **(You MUST NEVER expose the secret key in client-side code — use the publishable key in browsers, the secret key only on the server)** **(You MUST use `(select auth.uid())` wrapped in a subquery inside RLS policies for performance)** **(You MUST handle all Supabase responses with `{ data, error }` destructuring — never assume success)** </critical_requirements> --- **Auto-detection:** Supabase, createClient, @supabase/supabase-js, @supabase/ssr, supabase-js, auth.uid(), RLS, row level security, realtime, postgres_changes, supabase.auth, supabase.from, supabase.storage, supabase.functions, supabase.channel, edge function, Deno.serve **When to use:** - Setting up a Supabase client with TypeScript type safety - Implementing authentication (email/password, OAuth, magic links...