A database and sign-in with Supabase
Mangrove Kitchen shows recipes but can't remember anyone yet. Here you add a Supabase database and e-mail sign-in, so members can save favourite recipes, with every table locked by row-level security.
By the end you can
- Create a Supabase project and keep its password and keys in the right places
- Run the agent's SQL migrations in the SQL Editor and check the result
- Turn on row-level security for every table and read a simple policy
- Set up e-mail sign-in and test access as two users
The everyday picture
Think of an office building. Visitors get a day pass at reception. It opens the lobby for everyone, and each tenant's office only for that tenant. The manager's master key opens every door, so it never leaves the manager's office.
In Supabase, the publishable key is the day pass, row-level security is the door rules, and the secret key is the master key that ignores them.
Your project, its password and its keys
Supabase gives you a PostgreSQL database plus sign-in in one project. Screens are as of 2026; menus move, so look for the named setting.
- Sign in at supabase.com with GitHub and click New project.
- Name it
mangrove-kitchen. Click Generate a password and save it in your password manager right away. - Pick a region close to your visitors, such as Singapore or Mumbai for South Asia.
- Choose the free plan and click Create.
Then open Project Settings, then API Keys:
- Project URL: your database API's address. Not secret.
- Publishable key (
sb_publishable_…): safe in the browser, because your access rules limit it. - Secret key (
sb_secret_…): skips every access rule. Server only. Older projects call these the anon and service_role keys.
You copy these into .env.local yourself. Never paste a secret key into the agent's chat: chat history is stored. Tell the agent the variable names instead.
Quick check
The agent asks you to paste "the Supabase keys" into the chat so it can set up the project. What do you do?
The agent only needs the names; the app reads the values from .env.local, which Git ignores. A secret key in chat or code, even for a moment, is out of your control.