Guides

Short write-ups for the Lovable + Supabase bugs we keep seeing.

SUPABASE · RLS

Is my Supabase database public?

Anon key in the client is normal. RLS off is not. Copy the key, hit the REST endpoint with no login, and tell rows apart from empty, 401, and 42501.

SUPABASE · OCT 30, 2026

Starting October 30, existing projects stop auto-granting privileges on new public tables. You get 42501 permission denied even with RLS policies.

STRIPE · EDGE FUNCTIONS

Stripe never sends a Supabase JWT. verify_jwt returns 401 before your handler runs. Turn it off, then constructEventAsync on the raw body.

AUTH · PREVIEW VS PROD

Site URL, Redirect URLs, and the OAuth provider callback are three different lists. Production fails when only the preview host is allowlisted.

SUPABASE · RLS

The spinner succeeds, the row does not change. RLS USING matched zero rows, and supabase-js reports no error unless you .select().