available for auth features of Supabase

Not specified by the original author.

TL;DR

[chipilov (accepted answer)] Yes, there is a RESTful API. Supabase uses a modified version of Netlify's GoTrue server and you can communicate directly with it.

Steps

1. [chipilov (accepted answer)] Yes, there is a RESTful API. Supabase uses a modified version of Netlify's GoTrue server and you can communicate directly with it. The main page of the GitHub repo for Supabase's fork also includes docs for the endpoints. NOTE, that the Supabase.js auth methods are just wrappers around these APIs so you can also inspect the network calls each of these methods makes to get more practical information about the available APIs. Finally, NOTE that some of these RESTful APIs are available ONLY with the service_role API key (i.e. they can be safely called ONLY from a server environment).

When to use

You are seeing this: [chipilov (accepted answer)] Yes, there is a RESTful API. Use this skill when you run into "Is there RESTful API available for auth features of Supabase".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Edge cases

• NOTE, that the Supabase.js auth methods are just wrappers around these APIs so you can also inspect the network calls each of these methods makes to get more practical information about the available APIs.

Source: Stack Overflow #70719066 (accepted answer, 10 votes, 1 answers): We are trying out Supabase and found it awesome, especially about how easy it is to implement user authentication. So far we have been using the official JavaScript client library and everything we tried works (thumbs up to the devs!). Yet for some of our projects, we are using OCaml as the backend, which is not based on a JavaScript runtime. It seems that there exists client libraries for other native languages such as Go and Rust, and the official website documents RESTful API to access the database. I'd like to know if it is possible to integrate with the auth features provided by Supabas

Verified resolution: [chipilov (accepted answer)] Yes, there is a RESTful API. Supabase uses a modified version of Netlify's GoTrue server and you can communicate directly with it. The main page of the GitHub repo for Supabase's fork also includes docs for the endpoints. NOTE, that the Supabase.js auth methods are just wrappers around these APIs so you can also inspect the network calls each of these methods makes to get more practical information about the available APIs. Finally, NOTE that some of these RESTful APIs are available ONLY with the service_role API key (i.e. they can be safely called ONLY from a server environment).

Source URL: https://stackoverflow.com/questions/70719066

Not specified by the original author.

TL;DR

Add a tsvector column (or a generated one) combining the searchable fields with appropriate weights: title weight A, body weight B. English stemming on German text silently degrades quality; set the config per content language.

Steps

1. Add a tsvector column (or a generated one) combining the searchable fields with appropriate weights: title weight A, body weight B. Generated columns keep it in sync automatically.
2. Index it with GIN. Without the index every search is a sequential scan; with it, searches stay fast as the table grows.
3. Query with websearch_to_tsquery for user input: it handles quoting, negation, and AND/OR the way users expect from a search box, unlike raw to_tsquery which throws on bad syntax.
4. Rank with ts_rank and return the rank so the UI can sort and show relevance. Unranked full-text results feel broken even when the matching is right.
5. Pick the right language configuration for stemming. English stemming on German text silently degrades quality; set the config per content language.

When to use

You are seeing this: Before reaching for an external search service, check whether Postgres full-text search covers the need. Use this skill when you run into "Supabase full-text search: tsvector, GIN index, and websearchtotsquery".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/database/full-text-search

Not specified by the original author.

TL;DR

Set verify\_jwt = false in config.toml for functions called by external services (Stripe webhooks, cron triggers, third-party callbacks). Edge Functions run on Deno at the edge with two Supabase keys available. For user-scoped work, create the client with the anon (publishable) key and forward the caller's JWT: read the Authorization header from the request and set it on the client.

When to use

You are seeing this: Picking the wrong one is the most common agent failure: service role for everything (bypasses RLS, a security hole), or anon key for admin work (mysterious permission errors). Use this skill when you run into "Supabase Edge Functions: anon key for user work, service role for admin work, verify_jwt off for webhooks".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Supabase Edge Functions: key choice and JWT verification

Edge Functions run on Deno at the edge with two Supabase keys available. Picking the wrong one is the most common agent failure: service role for everything (bypasses RLS, a security hole), or anon key for admin work (mysterious permission errors).

Checkable procedure

1. For user-scoped work, create the client with the anon (publishable) key and forward the caller's JWT: read the Authorization header from the request and set it on the client. RLS then applies as that user. Verify with auth.getClaims() before trusting the user id.
2. For admin work (creating users, bypassing RLS for system writes), create a separate client with the service role key from Deno.env. Keep the two clients in clearly named variables; never let the service role client touch user input directly.
3. Set verify_jwt = false in config.toml for functions called by external services (Stripe webhooks, cron triggers, third-party callbacks). Those callers have no Supabase JWT, so verification 401s every request. Keep it on for functions your app calls with a user session.
4. Handle CORS: respond to OPTIONS with the CORS headers and include them on every response. Browser calls fail before your code runs if this is missing, and agents misdiagnose it as an auth problem.
5. Secrets go in the function secrets store (supabase secrets set), read via Deno.env. Never hardcode keys in the function source; deployed function code is visible to project members.

Quick test

Call the function with a user JWT and confirm RLS-scoped data returns. Call it with no JWT and confirm 401 when verifyjwt is on. Flip verifyjwt off for a webhook function and confirm the external caller gets through.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/functions