Managing User Data

For security purposes, the auth schema is not exposed on the auto-generated API.

Even though Supabase provides an auth.users table, it can be helpful to create tables in the public schema for storing user data that you want to access via the API.

Creating user tables#

When you create tables to store user data, it's helpful to reference the auth.users table in the primary key. This ensures data integrity.

For example, a public.profiles table might look like this:

1create table public.profiles (
2  id uuid references auth.users not null,
3  first_name text,
4  last_name text,
5
6  primary key (id)
7);
8
9alter table public.profiles enable row level security;

Public access#

Since Row Level Security is enabled, this table is accessible via the API but no data will be returned unless we set up some Policies. If we wanted the data to be readable by everyone but only allow logged-in users to update their own data, the Policies would look like this:

1create policy "Public profiles are viewable by everyone."
2  on profiles for select
3  using ( true );
4
5create policy "Users can insert their own profile."
6  on profiles for insert
7  with check ( auth.uid() = id );
8
9create policy "Users can update own profile."
10  on profiles for update
11  using ( auth.uid() = id );

Private access#

If the data should only be readable by the user who owns the data, we just need to change the for select query above.

1create policy "Profiles are viewable by users who created them."
2  on profiles for select
3  using ( auth.uid() = id );

The nice thing about this pattern? We can now query this table via the API and we don't need to include data filters in our API queries - the Policies will handle that for us:

1// This will return nothing while the user is logged out
2const { data } = await supabase.from('profiles').select('id, username, avatar_url, website')
3
4// After the user is logged in, this will only return
5// the logged-in user's data - in this case a single row
6const { error } = await supabase.auth.signIn({ email })
7const { data: profile } = await supabase
8  .from('profiles')
9  .select('id, username, avatar_url, website')

Bypassing Row Level Security#

If you need to fetch a full list of user profiles, we supply a service_key which you can use with your API and Client Libraries to bypass Row Level Security.

Make sure you NEVER expose this publicly. But it can be used on the server-side to fetch all of the profiles.

Advanced techniques#

Using triggers#

If you want to add a row to your public.profiles table every time a user signs up, you can use triggers. If the trigger fails however, it could block the user sign ups - so make sure that the code is well-tested.

For example:

1-- inserts a row into public.users
2create function public.handle_new_user()
3returns trigger
4language plpgsql
5security definer set search_path = public
6as $$
7begin
8  insert into public.profiles (id)
9  values (new.id);
10  return new;
11end;
12$$;
13
14-- trigger the function every time a user is created
15create trigger on_auth_user_created
16  after insert on auth.users
17  for each row execute procedure public.handle_new_user();