Supabase · sdk · fg-0199
Supabase client created with the service role key still gets RLS errors or empty results
new row violates row-level security policy from a client built with the service_role or sb_secret key
Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100
Cause
RLS is decided by the Authorization header, not the apikey header. SSR clients copy the user session from cookies into that header, and auth calls on a shared client replace it with the user's JWT.
Fix
Build a separate admin client with plain createClient, no cookies, and session persistence off. Create users with auth.admin.createUser rather than signUp on that client.
Apply
import { createClient } from '@supabase/supabase-js';
export const admin = createClient(process.env.SUPABASE_URL, process.env.SUPABASE_SECRET_KEY, {
auth: { persistSession: false, autoRefreshToken: false },
});Affects: supabase-js 2.x and @supabase/ssr; legacy service_role keys and new secret keys alike
Sources
- https://supabase.com/docs/guides/troubleshooting/why-is-my-service-role-key-client-getting-rls-errors-or-not-returning-data-7_1K9z
- https://github.com/supabase/ssr/issues/141
Have your agent know this before it fails
claude mcp add --transport http footgun https://getfootgun.com/api/mcp