---
title: "Supabase Middleware: composable, reusable middleware for Web Fetch handlers"
description: "Supabase released @supabase/middleware, a composable, type-safe library for Web Fetch handlers on October 2 at Supabase Select. It abstracts per-request logic like CORS handling, JWT verification, and feature flags into reusable entries that work across any fetch runtime and frameworks including Hono, H3, Elysia, NestJS, and TanStack Start. The pipeline function chains entries in order; each entry adds a typed key to a shared ctx object and can return a Response to short-circuit the chain, such as a 401 on invalid JWT. Built-in middleware includes withCors, withRequiredClaims, withSupabaseClient (scoped to the caller via RLS), and withPostgresAdminClient, and the pipeline produces a standard fetch handler portable to Node 22+, Deno, Bun, Cloudflare Workers, or frameworks via bridge files. Developers write custom middleware using defineMiddleware with compile-time type guarding for key conflicts and dependency order, and can share them as npm packages."
---

# Supabase Middleware: composable, reusable middleware for Web Fetch handlers

[Supabase](https://yomu.fyi/company/supabase) · tomas\_pozo,katerina\_skroumpelou · Oct 15, 2026

**Type:** Announcement

## Summary

Supabase released @supabase/middleware, a composable, type-safe library for Web Fetch handlers on October 2 at Supabase Select. It abstracts per-request logic like CORS handling, JWT verification, and feature flags into reusable entries that work across any fetch runtime and frameworks including Hono, H3, Elysia, NestJS, and TanStack Start. The pipeline function chains entries in order; each entry adds a typed key to a shared ctx object and can return a Response to short-circuit the chain, such as a 401 on invalid JWT. Built-in middleware includes withCors, withRequiredClaims, withSupabaseClient (scoped to the caller via RLS), and withPostgresAdminClient, and the pipeline produces a standard fetch handler portable to Node 22+, Deno, Bun, Cloudflare Workers, or frameworks via bridge files. Developers write custom middleware using defineMiddleware with compile-time type guarding for key conflicts and dependency order, and can share them as npm packages.

## Context

Per-request logic such as CORS, authentication, and feature flags is duplicated across handlers, runtimes, and frameworks, creating maintenance burden and security risks.

## Approach / What changed

A middleware library that uses a pipeline function to compose ordered, type-safe middleware entries into a standard fetch handler. Each entry handles one concern and adds a typed key to a shared ctx object. The same pipeline works on any fetch runtime and inside frameworks via a short bridge file.

## Takeaways

- Middleware entries in a pipeline execute sequentially; any entry can return a Response to halt the chain, enabling early rejection for invalid auth or missing flags.
- Built-in middleware like withSupabaseClient provides a caller-scoped Supabase client that respects Row-Level Security, eliminating manual token scoping in each handler.
- defineMiddleware enforces at compile time that middleware keys are unique and declared dependencies are satisfied, catching configuration errors before deployment.

## FAQ

### How does middleware work across different runtimes?

The pipeline function produces a standard fetch handler, which runs on any runtime that supports the Fetch API, including Node 22+, Deno, Bun, and Cloudflare Workers. For frameworks, a bridge file adapts the middleware to the framework's middleware format without rewriting the logic.

### Can I use withPostgresClient on Cloudflare Workers?

No, because pg requires a TCP socket, which Cloudflare Workers do not provide. On Workers, use withSupabaseClient and ctx.supabase instead.

### How do I create custom middleware?

Use defineMiddleware with a key, a run function that returns a request handler, and type parameters for config, dependencies, and outputs. TypeScript 5.4+ catches key conflicts and missing dependencies at compile time.

**Tags:** [Fetch](https://yomu.fyi/topic/fetch), [Middleware](https://yomu.fyi/topic/middleware), [Supabase](https://yomu.fyi/topic/supabase), [TypeScript](https://yomu.fyi/topic/typescript)

- Source: [Supabase](https://supabase.com/blog/supabase-middleware)
- Source URL: https://supabase.com/blog/supabase-middleware
- Ingested by Yomu: 2026-10-16T21:00:13.595Z

[Read original post](https://supabase.com/blog/supabase-middleware)