Supabase · api · fg-0206

Supabase Storage upload fails with 403 new row violates row-level security policy despite an INSERT policy

StorageApiError: new row violates row-level security policy (403)

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

The Storage API inserts the object row and reads it back in the same statement, so a missing SELECT policy fails the whole upload. Overwrites with upsert also need an UPDATE policy.

Fix

Add SELECT (and UPDATE if you overwrite) policies on storage.objects that mirror the INSERT policy's bucket and path checks.

Apply

create policy "read own files" on storage.objects for select to authenticated
  using (bucket_id = 'avatars' and (storage.foldername(name))[1] = (select auth.uid())::text);
create policy "update own files" on storage.objects for update to authenticated
  using (bucket_id = 'avatars' and (storage.foldername(name))[1] = (select auth.uid())::text);

Affects: Supabase Storage on all plans with RLS on storage.objects

Sources

https://supabase.com/docs/guides/troubleshooting/storage-error-403-forbidden-new-row-violates-row-level-security-policy-on-upload-a94384

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp