beginner · 20 minute study

Find the database behind the API

An SDK call hides several boundaries. Understanding them helps you debug denied rows without randomly changing keys, policies or browser code.

Loading progressEvidence grows with practice

Useful preparation · 1 prerequisite

Use this as a map, not a lock. If these ideas are familiar, continue.

Make impossible relationships unrepresentable — A form can look correct while an import or competing request writes a broken relationship. Integrity belongs at the data boundary every writer shares.

First, build a mental model

Supabase connects PostgreSQL, identity and APIs. Your client asks; authentication establishes an actor; privileges and policies decide what that actor may do.

The client SDK constructs requests. It does not turn untrusted browser logic into trusted authority.
A project API key identifies the application component. A user session identifies a person. Row access still depends on database privileges and policies.
Table grants decide whether a role may perform an operation on the object. Enabled RLS then decides which rows qualify; an empty result and a missing-grant error have different causes.
Database functions can expose a transaction boundary through RPC. Storage and Realtime are additional services to learn when a project uses them, not automatic dependencies for a static lesson.

Read the codejson · educational example

{
  "client": "browser application",
  "request": "read notes",
  "applicationKey": "publishable — not a user identity",
  "userSession": "Alice — verified separately",
  "databaseRole": "authenticated",
  "tablePrivilege": "SELECT",
  "rowRule": "Alice is a member of the note company"
}

Application
The public client can send a request even if a navigation link is hidden.
Identity
A trusted authentication mechanism establishes which user is asking.
Authority
The database evaluates the role's privilege and applicable row policies.

Production thinking

Take this beyond the example.

When debugging access, trace the actual path: client credentials/session → exposed object → table privileges → effective policies → result. Never solve a denied request by casually replacing it with a privileged client.

Sources and further reading

Your evidence

unseen is a local learning signal, not a credential or proof of production competence.

Explain the mental model, then explicitly acknowledge it. Opening a page is not evidence.

Supported retries can complete this lesson. Independent evidence and delayed review determine the skill stage.

Next lesson · Identity is not authority →