PlugWiki

Supabase Server Skill for Claude Code: What It Does and How to Install It

Makes your assistant write server-side Supabase code with the @supabase/server package: Edge Functions, Hono apps and webhook handlers.

Installs
10.1K
on skills.sh
Stars
94
on GitHub
Updated
Oct 2026
last repo commit

SKILL.md tells the assistant to load it before touching any file that imports @supabase/server. It explains the four auth modes (user, publishable, secret, none), the renamed options, quick starts, Edge Function recipes and a migration path from legacy patterns.

It also tells the assistant not to search the web, because the package is new, and to read the package docs in node_modules/@supabase/server/docs/. It bundles no scripts.

Good for

  • Developers writing Supabase Edge Functions or other server endpoints
  • Teams choosing the right auth mode for each endpoint
  • People moving old code off the anon and service_role keys

Install supabase-server

Claude Code

  1. 1

    Copy this prompt.

    Install the supabase-server skill in Claude Code. Run this command:

npx skills add supabase/server

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

The repo holds one skill, so the README command installs just supabase-server. The skill points to docs/ inside the @supabase/server package, so install the package in your project (npm install @supabase/server, or the npm: import for Deno and Edge Functions) for the agent to read them.

From the project README. Source.

What's in the skill

When it loads

Use when planning or writing server-side code that uses `@supabase/server` — Edge Functions, Hono apps, webhook handlers, or any backend that creates Supabase clients or validates inbound auth. Trigger **before** writing or modifying any file that imports from `@supabase/server` (or sub-paths like `@supabase/server/core`); calls `withSupabase`, `createSupabaseContext`, `createAdminClient`, `createContextClient`, `verifyAuth`, `verifyCredentials`, or `extractCredentials`; configures an `auth:` mode (`'none'` | `'publishable'` | `'secret'` | `'user'`, or keyed variants like `'secret:*'`); or lives under `supabase/functions/` and authenticates an inbound request. Also trigger during planning — if a plan mentions any of the above, load the skill before drafting code; do not extrapolate `auth:` values or auth modes from neighboring functions. Also trigger when you see legacy patterns to migrate to this package — `Deno.serve`, `createClient(Deno.env.get('SUPABASE_URL'))`, imports from `esm.sh/@supabase` or `deno.land/std`, usage of `SUPABASE_ANON_KEY` / `SUPABASE_SERVICE_ROLE_KEY`, or the deprecated `allow:` config option / removed `'always'` / `'public'` mode values / removed `authType` field.

Sections in SKILL.md

  1. What this package does
  2. Entry points
  3. Quick starts
  4. Supabase Edge Functions (Deno)
  5. Cloudflare Workers
  6. Hono
  7. Cookie-based environments (compose with @supabase/ssr)
  8. Server-to-server (secret key auth)
  9. Pin user tokens to one project
  10. When to use auth: 'none'
  11. Edge Function recipes
  12. Function-to-function calls
  13. Calling from database with pg_net
  14. Stripe webhook
  15. Migrating legacy Edge Functions
  16. Documentation

Key facts

Author
Supabase (vendor's own repo)
Repo
supabase/server
License
MIT (LICENSE)
Installs on skills.sh
10,146 (Nov 2, 2026)
GitHub stars
94 for the whole supabase/server repo (Nov 2, 2026)
Last repo commit
Oct 19, 2026
Audits on skills.sh
Gen Agent Trust Hub: pass, Socket: pass, Snyk: warn
What it includes
1 file: SKILL.md (counted from the repo tree)
Covers
The @supabase/server package: Edge Functions, Cloudflare Workers, Hono, @supabase/ssr apps

What it includes

  • Four modes: user (JWT), publishable, secret and none, plus arrays and named secret keys.

    Array syntax is first match wins. A present but invalid JWT is rejected, not downgraded.

    Try: “Add an authenticated endpoint that lists the signed-in user todos.”

    Write · Auth modes

  • Quick starts for Supabase Edge Functions (Deno) and Cloudflare Workers.

    SKILL.md says all Deno imports use the npm: specifier, and non-user auth needs verify_jwt = false in supabase/config.toml.

    Write · Edge Functions and Workers

  • Copies one bridge file into src/lib and runs @supabase/middleware entries in Hono.

    Runs npm install @supabase/middleware and curl from the repo main branch. The older Hono adapter is deprecated and removed on December 1, 2026.

    Runs code · Hono bridge

  • Composes @supabase/server with @supabase/ssr for Next.js, SvelteKit and Remix.

    Write · Cookie-based apps

  • Named secret keys (secret:name or secret:*) for cron jobs and internal callers.

    Write · Server-to-server secret keys

  • audience and issuer options check the aud and iss claims of user tokens.

    Write · Pin user tokens

  • Says to confirm with you that an endpoint is truly public before using none.

    SKILL.md suggests secret keys for cron jobs and signature checks for webhooks instead.

    Read · auth: none guard

  • Function-to-function calls, calling from the database with pg_net, and a Stripe webhook.

    The Stripe recipe uses supabase secrets set; the pg_net recipe stores a secret key in Vault with SQL.

    Runs code · Edge Function recipes

  • Replaces SUPABASE_ANON_KEY and SUPABASE_SERVICE_ROLE_KEY patterns with auth modes.

    Also moves the allow option to auth and authType to authMode.

    Write · Migrating legacy functions

  • Points to docs/ in node_modules/@supabase/server and a table of 14 questions.

    SKILL.md says not to search the web, because the package is new.

    Files · Docs lookup

From the official docs

Permissions

Medium risk

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It writes your authentication code

    The skill chooses auth modes for endpoints. A wrong choice, such as auth none, runs a handler with no credential checks. SKILL.md says to confirm with you before using none. Review every auth value it writes. github.com

  • It fetches a file from the repo main branch

    The Hono recipe runs curl to download src/lib/supabase-middleware.ts from raw.githubusercontent.com/supabase/server/main and says to keep it as is. Read the file before you use it. github.com

  • Recipes handle secret keys

    The examples show supabase secrets set with a Stripe key and a Vault call that stores an sb_secret_ key, and an admin client that bypasses row level security. Keep real keys out of prompts and commits. github.com

  • verify_jwt must be off for some modes

    For publishable, secret and none auth, SKILL.md says to set verify_jwt = false in supabase/config.toml. That removes the platform JWT check for that function. github.com

Technical details
Turning on read-onlyNo read-only mode is documented.
Talks toraw.githubusercontent.com (Hono bridge file from the repo main branch). npm registry (@supabase/middleware)
Sign-in and keysThe code it writes reads Supabase keys from environment variables. SKILL.md says Edge Functions get them injected by the platform.
Scopes

  • Edits server-side auth code in your project

  • Handles Supabase publishable and secret keys in the code it writes

  • Runs npm install and curl for the Hono bridge

  • Shows SQL and CLI commands that store or set secrets

Questions

What does the supabase-server skill do?

It teaches your assistant to write server-side code with the @supabase/server package: Edge Functions, Hono apps and webhook handlers. The package handles inbound auth, Supabase client creation and CORS.

How do I install it?

Use the install box at the top of this page. The README gives one skills CLI command for the supabase/server repo.

Do I need an API key?

The code it writes uses Supabase publishable or secret keys from environment variables. SKILL.md tells the agent to avoid the legacy anon and service_role keys unless you ask for them.

Is it safe?

It writes authentication code that guards your data, so a wrong auth mode can expose an endpoint. Our advice: read each auth value in the diff, and never paste real secret keys into a prompt.

Is it the official Supabase skill?

It is in Supabase's own supabase/server repo, and the README tells you to install it for AI coding agents. It covers only the @supabase/server package, not Supabase in general.

What changed from the 0.x versions?

SKILL.md says allow was renamed to auth, the always and public values became none and publishable, and authType became authMode. The README links a migration guide.

Does it work with Next.js or SvelteKit?

Yes, with @supabase/ssr. SKILL.md says to compose the two packages, because @supabase/ssr owns cookies and refresh-token rotation.

Does it work in the Claude app?

The install box has no Claude app upload route. The skill is for writing code inside a project, and it points to docs in your installed node_modules.

Information

updated Nov 2, 2026

Repository
supabase/server
Folder
skills/supabase-server

supabase/serverskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 2
  1. supabase/server README · github.com
  2. supabase-server SKILL.md · github.com

Updated Nov 2, 2026.