How to turn on Supabase row-level security, in plain English

Supabase apps talk to the database straight from the browser, using a public key that is visible in your page source. That is by design. The thing that makes it safe is row-level security. Turn it off and the public key becomes a key to the whole table.

In the Supabase dashboard, open the table and enable RLS, or run this in the SQL editor. Replace bookings with your table name.

alter table public.bookings enable row level security;

With RLS on and no policy, nobody can read the table through the API, which usually breaks a screen. Add a policy that lets each signed-in user read only the rows that belong to them. This assumes the table has a user_id column that stores the owner's id.

create policy "Owners can read their bookings"
on public.bookings
for select
to authenticated
using ((select auth.uid()) = user_id);

A select policy only covers reading. Add one policy per action you need, each limited to the owner. For inserts, the check goes in with check rather than using.

create policy "Owners can add bookings"
on public.bookings
for insert
to authenticated
with check ((select auth.uid()) = user_id);

• using (true): this lets everyone read the table and is the same as RLS off.
• Policies for the anon role on tables with personal data.
• Turning RLS off to fix a permissions error. Fix the policy instead.
• Views that query a protected table. Create them with security_invoker = true so they respect the caller's policies.

Sign out of your app and try to load the data, or follow our guide on testing whether your tables are public with your own anon key. If a row comes back without signing in, the policy is still too open.