Python + Supabase: verify server-side with auth.get_user, one client per process
Guide Python + Supabase: verify server-side with auth.get_user, one client per process: Create the client with # Python + Supabase: server-side verification discipline supabase-py runs on your server, but agents write it as if the client session is trustworthy. Use this when you hit exactly this in Python + Supabase. Not for different errors or different tools.
TL;DR: Create the client with # Python + Supabase: server-side verification discipline supabase-py runs on your server, but agents write it as if the client session is trustworthy. It is not: any session object your Python code receives came from the client and must be verified before you act on it. ## Checkable procedure 1.
Python + Supabase: server-side verification discipline
supabase-py runs on your server, but agents write it as if the client session is trustworthy. It is not: any session object your Python code receives came from the client and must be verified before you act on it.
Checkable procedure
- Create the client with
create_client(url, key)once per process (or per request in async servers). The anon/publishable key is fine for user-scoped queries; use the service role key only in a separate, clearly named admin client. - To identify the caller, take the JWT from the request's Authorization header and call
auth.get_user(jwt). This hits the Auth server and returns the verified user. Do not decode the JWT locally and trust the payload. - For RLS to apply as the user, run queries on a client carrying that user's JWT. A service-role client bypasses RLS entirely, so mixing them up is either a data leak or a debugging nightmare.
- In scripts and notebooks, prefer the service role key only when the script genuinely needs admin powers, and keep it out of committed code. Use environment variables.
- Storage uploads from Python: use the signed-URL flow for user uploads rather than handing out the service key. The client uploads directly to the signed URL; your server never proxies the bytes.
Quick test
Pass a forged JWT to your endpoint and confirm get_user rejects it. Pass a valid user JWT to a service-role query path and confirm you have not accidentally bypassed RLS on user data.
When to use
You hit exactly this: Python + Supabase: verify server-side with auth.get_user, one client per process in Python + Supabase.
When not to use
A different error, or the same symptom in a different tool. This page only covers the failure above.
Compatibility
Python + Supabase.
Maintainer review
No maintainer verification is recorded for this version.
This records the version a maintainer checked. It does not assert that the version is the latest upstream release.