Skip to content
Back to the playbook

Diagnosing a Supabase RLS INSERT rejection

SupabasePostgreSQLrevision 1

Diagnostic tree

  1. In progressRLS is rejecting an INSERT the app performs, but the SQL editor succeedsThat contrast is itself the clue: the SQL editor runs as a privileged role that bypasses RLS entirely (the same is true of a server-side call using the service_role key), so it proves nothing about whether a real app-facing policy exists — it will 'work' even with zero policies on the table.
View the whole map (8 more steps)
  • Confirm RLS is enabled and see what policies exist
  • Does an INSERT-covering policy's WITH CHECK actually match this row and role?
  • No policy permits this INSERT at all
  • Policy logic looks correct — check which key/role the client is actually using
  • WITH CHECK doesn't match how the row is actually being inserted
  • Add or correct the INSERT policy
  • Re-check the policy exists, then re-test as a real signed-in user
  • Resolved

What to test

RLS is rejecting an INSERT the app performs, but the SQL editor succeeds

That contrast is itself the clue: the SQL editor runs as a privileged role that bypasses RLS entirely (the same is true of a server-side call using the service_role key), so it proves nothing about whether a real app-facing policy exists — it will 'work' even with zero policies on the table.

What happened?

Passed