Replit app says "permission denied for table"

Why this happens in Replit projects

When Replit adds a table to your Supabase database, the table lands in the public schema. Supabase used to grant every new public table to the API roles on its own. It no longer does, so the first request to the new table fails with 42501 until the grants exist.

• Before: every new table in public was granted to anon, authenticated and service_role automatically.
• After the change: a new table has no grants until you write them. The Data API answers 42501, permission denied for table.
• Tables that already existed keep their grants. Row level security works as before.

How to apply the fix from Replit

We did not find official Replit documentation for this error (checked 2026-11-10), so nothing here is specific to Replit's screens. The database side is the same for every tool: run the SQL in the Supabase SQL Editor. Give the fix prompt to the Replit agent so that future tables include their grants.

1. Paste the table into the tool above and choose the access you want.
2. Open the Fix prompt tab. The prompt tells the builder to add the SQL unchanged, and to include grants with every table it creates from now on.
3. Or skip the builder: copy the GRANT + RLS tab and run it in the Supabase SQL Editor.

What the SQL looks like

For a table where each signed-in user sees only their own rows:

-- public.your_table: owner only
alter table public.your_table enable row level security;
revoke all on table public.your_table from anon, authenticated;
grant select, insert, update, delete on table public.your_table to authenticated;
grant select, insert, update, delete on table public.your_table to service_role;
drop policy if exists your_table_select_own on public.your_table;
create policy your_table_select_own on public.your_table
  for select to authenticated
  using ( (select auth.uid()) = user_id );
drop policy if exists your_table_insert_own on public.your_table;
create policy your_table_insert_own on public.your_table
  for insert to authenticated
  with check ( (select auth.uid()) = user_id );
drop policy if exists your_table_update_own on public.your_table;
create policy your_table_update_own on public.your_table
  for update to authenticated
  using ( (select auth.uid()) = user_id )
  with check ( (select auth.uid()) = user_id );
drop policy if exists your_table_delete_own on public.your_table;
create policy your_table_delete_own on public.your_table
  for delete to authenticated
  using ( (select auth.uid()) = user_id );

Dates are from the Supabase changelog post published 2026-04-28, read 2026-11-10. We have not seen an official post confirming that the 2026-10-30 step finished for every project, so check your own project with this query.

Sources

• Supabase changelog: Breaking Change: Tables not exposed to Data and GraphQL API automatically (published 2026-04-28), read 2026-11-10
• Supabase docs: Securing your API, read 2026-11-10