Remix + Supabase: per-request server client in loaders and actions with cookie session storage

Remix + Supabase: per-request server client in loaders and actions with cookie session storage

TL;DR

Every Remix loader and action receives the request, and that is where the Supabase client belongs. The two failure modes are a module-level client shared across requests, and a client whose refreshed cookies are never written back to the response. Sign in through an action, then immediately load a protected route.

Use this when you run into the situation in the title.

When not to use this skill: unrelated tasks. It covers only the procedure above.

Steps

1. Write a getSupabaseClient(request) helper that builds createServerClient from @supabase/ssr per call, with cookies read from the request's Cookie header.

   Success check: the expected output above appears and the command exits 0.

2. After any auth operation in an action (sign in, sign out, refresh), write the client's updated cookies onto the redirect/response you return. If you return a fresh redirect() without copying the setAll cookies, the browser never stores the new session and the user bounces back to login.

   Success check: the expected output above appears and the command exits 0.

3. In loaders, verify with auth.getClaims() before returning user-scoped data. A loader that trusts a user id from the URL instead of the session is an IDOR waiting to happen.

4. Client-side components use createBrowserClient. Do not pass the server client into the browser via loader data, it carries no usable session there and confuses the next agent.

   Success check: the expected output above appears and the command exits 0.

5. Supabase Auth UI or custom forms both work, but the session must end up in cookies for loaders to see it. Token-in-localStorage alone is invisible to loaders.

Compatibility

Tool: Supabase. The steps above apply to the commands named in them. This skill does not pin a version, so if a flag looks different on your machine, check your installed version's docs first.

Details

Remix + Supabase: the client lives and dies with the request

Quick test

If the protected loader sees you as logged out, the action did not write cookies back onto its response.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/auth/server-side/creating-a-client