|
| 1 | +--- |
| 2 | +title: "Authenticating Supabase tasks: JWTs and service roles" |
| 3 | +sidebarTitle: "Supabase authentication" |
| 4 | +description: "Learn how to authenticate Supabase tasks using JWTs for Row Level Security (RLS) or service role keys for admin access." |
| 5 | +--- |
| 6 | + |
| 7 | +import SupabaseDocsCards from "/snippets/supabase-docs-cards.mdx"; |
| 8 | + |
| 9 | +There are two ways to authenticate your Supabase client in Trigger.dev tasks: |
| 10 | + |
| 11 | +### 1. Using JWT Authentication (Recommended for User-Specific Operations) |
| 12 | + |
| 13 | +A JWT (JSON Web Token) is a string-formatted data container that typically stores user identity and permissions data. Row Level Security policies are based on the information present in JWTs. Supabase JWT docs can be found [here](https://supabase.com/docs/guides/auth/jwts). |
| 14 | + |
| 15 | +To use JWTs with Supabase, you'll need to add the `SUPABASE_JWT_SECRET` environment variable in your project. This secret is used to sign the JWTs. This can be found in your Supabase project settings under `Data API`. |
| 16 | + |
| 17 | +This example code shows how to create a JWT token for a user and initialize a Supabase client with that token for authentication, allowing the task to perform database operations as that specific user. You can adapt this code to fit your own use case. |
| 18 | + |
| 19 | +```ts |
| 20 | + |
| 21 | +// The rest of your task code |
| 22 | +async run(payload: { user_id: string }) { |
| 23 | + const { user_id } = payload; |
| 24 | + |
| 25 | + // Optional error handling |
| 26 | + const jwtSecret = process.env.SUPABASE_JWT_SECRET; |
| 27 | + if (!jwtSecret) { |
| 28 | + throw new Error( |
| 29 | + "SUPABASE_JWT_SECRET is not defined in environment variables" |
| 30 | + ); |
| 31 | + } |
| 32 | + |
| 33 | + // Create a JWT token for the user that expires in 1 hour |
| 34 | + const token = jwt.sign({ sub: user_id }, jwtSecret, { expiresIn: "1h" }); |
| 35 | + |
| 36 | + // Initialize the Supabase client with the JWT token |
| 37 | + const supabase = createClient( |
| 38 | + // These details can be found in your Supabase project settings under `Data API` |
| 39 | + process.env.SUPABASE_URL as string, |
| 40 | + process.env.SUPABASE_ANON_KEY as string, |
| 41 | + { |
| 42 | + global: { |
| 43 | + headers: { |
| 44 | + Authorization: `Bearer ${token}`, |
| 45 | + }, |
| 46 | + }, |
| 47 | + } |
| 48 | + ); |
| 49 | +// The rest of your task code |
| 50 | +``` |
| 51 | +
|
| 52 | +Using JWTs to authenticate Supabase operations is more secure than using service role keys because it respects Row Level Security policies, maintains user-specific audit trails, and follows the principle of least privileged access. |
| 53 | +
|
| 54 | +### 2. Using Service Role Key (For Admin-Level Access) |
| 55 | +
|
| 56 | +<Warning> |
| 57 | + The service role key has unlimited access and bypasses all security checks. Only use it when you |
| 58 | + need admin-level privileges, and never expose it client-side. |
| 59 | +</Warning> |
| 60 | +
|
| 61 | +This example code creates a Supabase client with admin-level privileges using a service role key, bypassing all Row Level Security policies to allow unrestricted database access. |
| 62 | +
|
| 63 | +```ts |
| 64 | +// Create a single Supabase client for interacting with your database |
| 65 | +// 'Database' supplies the type definitions to supabase-js |
| 66 | +const supabase = createClient<Database>( |
| 67 | + // These details can be found in your Supabase project settings under `API` |
| 68 | + process.env.SUPABASE_PROJECT_URL as string, // e.g. https://abc123.supabase.co - replace 'abc123' with your project ID |
| 69 | + process.env.SUPABASE_SERVICE_ROLE_KEY as string // Your service role secret key |
| 70 | +); |
| 71 | + |
| 72 | +// Your task |
| 73 | +``` |
| 74 | +
|
| 75 | +<SupabaseDocsCards /> |
0 commit comments