Introducing @supabase/server

Summary

Supabase is releasing @supabase/server in public beta, a package for authentication verification, client setup, request context, and common server-side boilerplate across backend runtimes. Supabase says an anonymous analysis of 25,000 deployed Edge Functions found developers repeatedly rebuilding setup for clients, JWT verification, claims parsing, CORS, auth context, and shared files. The package's withSupabase wrapper or createSupabaseContext function supplies a SupabaseContext containing a user-scoped client, service-role admin client, verified identity, JWT claims, auth metadata, and auth mode, while declarative modes cover user, none, secret, publishable, or combined access. It returns standard Request-to-Response handlers for Edge Functions, Vercel Functions, Cloudflare Workers, Hono, Bun, and Deno, and includes primitives for custom middleware and adapters. @supabase/server does not replace @supabase/ssr, which remains focused on cookie-based sessions, and the release invites feedback on its public-beta API and adapters.

Takeaways

1. 1

   withSupabase supports declarative auth modes for users, unauthenticated requests, secret keys, publishable keys, or combinations of user and secret authentication.

2. 2

   The context exposes both an RLS-respecting user-scoped Supabase client and a service-role admin client for privileged operations.

3. 3

   @supabase/server supports standard Request/Response handlers across Edge Functions, Vercel Functions, Cloudflare Workers, Bun, Deno, and Hono, while @supabase/ssr remains focused on cookie-based session management.