Rowpass 42501: permission denied for table Not affiliated with Supabase

Rowpass / Guides

Private, server-only table

No access from the browser. Your server reads and writes.

-- public.your_table: private
alter table public.your_table enable row level security;
revoke all on table public.your_table from anon, authenticated;
grant select, insert, update, delete on table public.your_table to service_role;
-- no policies: with RLS on and no policy, anon and authenticated read nothing.
-- service_role bypasses RLS. Keep its key on your server only.

How it stays private

  • anon and authenticated have no grant, so the Data API answers 42501 to any browser request.
  • RLS is on with no policy, a second barrier if a grant is added by mistake later.
  • service_role has the table privileges and bypasses RLS. It is used with the secret key, which must stay on the server.

Fits: audit logs, payment records, internal queues, anything written by a webhook or an edge function.

One detail from Supabase's RLS guide: a secret key bypasses RLS only when the request carries no user access token. If it carries one, the request runs under that user's policies.

Write the fix for your tables

One table is free. The whole schema with a rollback file is $9 one-time, free during launch.

 

Waiting for a paste.

    Who can reach each table

    Your tables show up here, one row each, with a choice of who can reach them.

    The SQL appears here as soon as a table is found.

    Parsed in your browser. Your SQL is never uploaded, and no site or database is scanned.

    Questions

    My app still shows 42501 for this table.

    Then the browser is calling it directly. That is the table doing its job. Move the call to server-side code, or choose a different access level.

    Sources

    Related

    Did it fix your error?