Keep the Supabase service role key out of the browser bundle

Open · 121 viewsasked 2 weeks ago by mira_dev

One file that holds the admin client, and an import that makes the build fail if a client component ever reaches for it. The grep at the bottom is worth running after any session where the agent touched data access.

Snippet

Copied 12 times

// lib/supabase/admin.ts
import "server-only";
import { createClient } from "@supabase/supabase-js";

// This client bypasses RLS. Never import it from a Client Component.
export const supabaseAdmin = createClient(
  process.env.NEXT_PUBLIC_SUPABASE_URL!,
  process.env.SUPABASE_SERVICE_ROLE_KEY!,
  { auth: { persistSession: false, autoRefreshToken: false } }
);

// Check nothing else touches the key:
// grep -rn "SERVICE_ROLE" app components | grep -v "lib/supabase/admin"

Comment

The server-only import is the best cheap guardrail there is.

amir_h 2 weeks ago

Build failed the moment I added it. A client component was importing the admin client. Yikes. tuan_ng 2 weeks ago

Keyboard shortcuts

Keep the Supabase service role key out of the browser bundle

Snippet

Activity