Overview

aSaaSin uses Supabase for authentication, database, and storage. This guide covers creating a project, adding environment variables, and applying the included migrations/seed.

Create a project

  1. Sign in at supabase.com and create a new project.
  2. Choose an organization, set Project name and Database password.
  3. Wait until the project is provisioned.

Get your API keys

In your Supabase dashboard open Project settings → API and locate:

  • Project URL (supabase URL)
  • anon public key
  • service_role key (server-side only—keep private)

Add to env

# Supabase
NEXT_PUBLIC_SUPABASE_URL=
NEXT_PUBLIC_SUPABASE_ANON_KEY=
SUPABASE_SERVICE_ROLE_KEY=

Save the file, then restart your dev server if it was running.

What each key is for

  • NEXT_PUBLIC_SUPABASE_URL — Your project’s API URL (safe to expose).
  • NEXT_PUBLIC_SUPABASE_ANON_KEY — Public anon key for browser and server calls that require no elevated privileges (safe to expose).
  • SUPABASE_SERVICE_ROLE_KEY — Service role key for privileged server-only tasks (never expose to the browser).

aSaaSin uses:

  • Browser client with the anon key for public calls.
  • Server client (RSC/middleware) with anon key + cookie passthrough for auth/session refresh.
  • Admin client with the service role key for scripts (e.g., storage initialization).

Apply migrations & initialize storage

The repository includes SQL migrations and a storage initializer. Make sure the Supabase CLI is installed (follow the official installation guide), then run:

 # Push database schema and initialize storage buckets
yarn setup

The setup script runs:

  • supabase db push - applies all migrations to your project.
  • tsx scripts/initStorage.ts - ensures required storage buckets exist via the service role client.

If you prefer to create buckets manually, add avatars as a public storage bucket in
Project settings → Storage → Create bucket.

  • Keep SUPABASE_SERVICE_ROLE_KEY server-only.
  • Rotate keys if compromised.
  • Lock down production environments (IP allowlists, webhook secrets, least privilege).