Marked as helpful by the asker
auth.admin.* exists, but only works with the service role key, on a server. In the browser you (correctly) have the anon key, hence "User not allowed". Please don't fix that by putting the service key in the client.
You don't need the auth API for this at all. Public profile data belongs in your own table:
create table public.profiles (
id uuid primary key references auth.users on delete cascade,
display_name text,
avatar_url text
);
alter table public.profiles enable row level security;
create policy "profiles are public" on public.profiles for select using (true);const { data } = await supabase.from('profiles').select('display_name, avatar_url').eq('id', params.id).single()Fill it with a trigger on auth.users insert, the Supabase docs have the standard one.
