supabase RLS with clerk

[MincePie]

Im trying to figure out how to use RLS with supabase, where users are created via clerk webhook. My users table has an id attribute and a clerk_id attribute. I don't know why it is in that form.

I've just realised that the supabase RLS check for permitting users to interact with their own data, in the form suggested by its helpers, checks auth.uid() = table_id - where auth.uid() is referencing clerk_id. I can't make that my foreign key because its a string. user.id is a uuid so the tables that have an id (as a uuid) and which reference the id on the other table, also need to be a uuid.

is there a way to make clerk webhooks make a user where the user.id is used in the RLS policy so that auth.uid() is actually the user.id instead of the clerk_id?

[GaryAustin1]

These Clerk guides show a function that is needed and how they do generation of the custom token...

https://supabase.com/partners/integrations/clerk
https://clerk.com/docs/integrations/databases/supabase

[GaryAustin1]

Keeping in same thread.

If you are not using Supabase auth then auth.users is not involved and that is the assumption using Clerk. Then all your user_id columns should be the Clerk user_id string columns (not UUID). All foreign keys should link back to that in your own users table if you have and it's primary key is your Clerk id (from the sub claim in the jwt). Then in RLS you don't use auth.uid() you use the clerk function to verify.

If you are using Supabase auth, or you need a user UUID column, then things are more complicated and you likely need a join table. That could be done in a user table if it has both ids. Then in RLS you have to look up either id in a select on that table and use the appropriate auth.uid() or Clerk id function in a Where clause to get the row selected and the other id you need to compare against your table user_id column.

[MincePie]

But the clerk approach only works if i want to use an authed user for every action. I dont. That's why I made a users table that has id (uuid) and clerk_id (string).

If i want the RLS policy to use the requesting_user_id() check against the creator_id(which is set with a default of requesting_user_id() (so the users.clerk_id) then I understand how to make a RLS policy.

However, if I want to check that the current user is the host_id then I think I need to find a way to check the clerk_id is unique to the users.id and the users.id is equal to the foreign key on the other table. I'm trying to understand if this is the expected approach (or if there is a simpler one) and either way, how I can do this. If I have to make a join table on every foreign key, then it seems odd to me that I have a foreign key at all.

[GaryAustin1]

You have not shown any example of your table structure or where your id's are coming from besides Clerk.
If your request starts with a Clerk JWT that is the ONLY secure thing you can compare against. If your table has a user_id UUID column only, then you have to go read another table with the Clerk function to select to get a user UUID for the matching Clerk ID in that table.

Why are you using a UUID different from the Clerk ID in your tables? The normal thing is to use an ID that matches your JWT claim so you don't have to look it up in another table and pay that penalty.

If I am misunderstanding and your REST call is using another user UUID id from somewhere in a filter then that would not be secure. It has to be in a JWT.

[MincePie]

Yes - I know. I have them and I have made a creator_id on my events table that uses requesting_user_id() as its default value. However, I also have a user table (with a clerk webhook to make an entry in the user table when a clerk user is registered). The user table has an id (uuid) attribute and a clerk_id(string) attribute.

i can see from the logs, that when I log the useUser details, the id returned is the clerk_id (prefix is user_). The user.id is a uuid and does not map to this value.

So - if I want to make an RLS policy that says the signedInUser has a user.id that is the same as the event.host_id then the RLS policy would need to be something that checks if the host_id (uuid on the events table) is equal to the user.id (uuid on users table) that is unique to a clerk_id (string on the users table) that is equal to auth.uid().

I don't know how to write that in the RLS policy creator. I also think this seems very complicated. I could use the creator_id attribute on the events table (which should map to the auth.uid() value in an RLS policy, but then I need to make two user id keys on the events table.

I think the clerk docs assume that I wont want to make a users table. If I do want a users table, is there a way to use a join in the RLS policy that lets me map auth.uid() (which is the saved value in users.clerk_id) to users.id to then match to events.host_id?

[MincePie]

If I remove the host_id altogether and just use the events.creator_id (which is a foreign key to users.clerk_id). I can see these match and are generated in the same form, then I make a policy that looks just like the docs say:

alter policy "allow create"

on "public"."events"

to authenticated

with check (

7
(requesting_user_id() = creator_id)

);

or alternatively trying without the authenticated constraint (so default to public):

Use options above to edit

alter policy "allow create"

on "public"."events"

to public

with check (

7
(requesting_user_id() = creator_id)

);

then i get an error that says:

Event Action Error: {
code: '42501',
details: null,
hint: null,
message: 'new row violates row-level security policy for table "events"'
}

if the policy is set to true with no checks, then I can create the event. I can log the users.clerk_id and see that it is the same as the useAuth id from clerk.

[GaryAustin1]

When you do insert you need either have the default for the id column be requesting_user_id() or provide the creator_id in your insert is my guess. If you do a select() on the insert call then you also need to meet the select policy.

Also you do want the authenticated in the policy in general as it will more quickly weed out anon user access without having to do RLS on each row.

[GaryAustin1]

You still have not shown a table or call, so I'm just guessing.

[MincePie]

the events table has an attribute named creator_id. that field is set with a default value of requesting_user_id(). I can see that this is working because I can make an entry in my events table, and the value stored in the creator_id field is the same as the clerk_id stored on my users table (which is the same as the id stored on the clerk users dashboard).

the events table has the following properties.

Name

Type
Default Value

Primary
id

uuid
gen_random_uuid()

created_at

timestamptz
now()

title

text
NULL

comment

text
NULL

1

date

date
NULL

1

time

timetz
NULL

1

virtual

bool
NULL

1

linkToVirtual

varchar
NULL

1

status_id

uuid
NULL

1

creator_id

text
'requesting_user_id'::text

1

maxGroupSize

int2
NULL

1

location

text
NULL

1

Add column
Foreign keys
events_status_id_fkey

Foreign key relation to:

public.status
status_id
public.status.id

Edit

Remove
events_creator_id_fkey

Foreign key relation to:

public.users
creator_id
public.users.clerk_id

Edit

Remove

I'm not clear on whether the supabase roles documentation only applies to apps using supabase auth to manage users or if its for anyone authorising (by any means) to access supabase. I can't check because even when I set the insert event policy to true (but use the authenticated role instead of the public default), i still get an RLS violation (which I don't get if the public default is true).

[GaryAustin1]

You last statement says to me you are not passing in the JWT from Clerk. It has to be in the Authorization header of your call (The Clerk docs show how to do this). That JWT Should have a role claim in it.
Your default does not look right either 'requesting_user_id'::text That just puts the word requesting_user_id in the text column. My guess is you then also in your insert you are also providing the Clerk user id which overrides the default. You would need requesting_user_id() in the default to call the function to get the SUB claim from the JWT.

[MincePie]

I'm very grateful to you for trying to help me but I dont understand either of your comments.

Step 6 of this supabase config instruction tells me how to configure supabase to incldue the headers. I've implemented it as follows:

import { useSession } from '@clerk/nextjs';
import { useEffect, useState, useMemo } from 'react';
import { createClient, SupabaseClient } from '@supabase/supabase-js';
import { Database } from './types/supabase';

export function useSupabaseClient() {
const { session, isLoaded } = useSession();
const [isInitializing, setIsInitializing] = useState(true);

const supabaseClient: SupabaseClient = useMemo(() => {
return createClient(
process.env.NEXT_PUBLIC_SUPABASE_URL!,
process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
{
global: {
fetch: async (url, options = {}) => {
if (session) {
const clerkToken = await session.getToken({ template: 'supabase' });
const headers = new Headers(options?.headers);
headers.set('Authorization', Bearer ${clerkToken});
return fetch(url, {
...options,
headers,
});
}
return fetch(url, options);
},
},
}
);
}, [session]);

useEffect(() => {
const setupSupabase = async () => {
setIsInitializing(true);
if (session) {
try {
const { data, error } = await supabaseClient.auth.getUser();
if (error) {
console.error('Error retrieving user from Supabase:', error.message);
} else if (data?.user) {
console.log('Authenticated Supabase User ID:', data.user.id);
} else {
console.error('No authenticated user found in Supabase.');
}
} catch (error) {
console.error('Error setting up Supabase client:', error);
}
}
setIsInitializing(false);
};

if (isLoaded) {
  setupSupabase();
}

}, [session, isLoaded, supabaseClient]);

return { supabase: supabaseClient, isInitializing };
}

I can't see a role example in this documentation. I have set the value to the default (I'll come back to figuring out whether the supabase documentation on roles still applies when using clerk). I'm trying to focus on the requesting_user_id() aspect of this check for the moment. Given the value is default, then even if there is another configuraiton step documented somewhere that tells me how to include a role parameter, it shouldn't matter for now.

I also don't understand your comment about the default value in the events table creator_id attribute. I typed in the value and it saved it in the format I shared. Whatever it was doing, it actually inserts the value of the clerk userId into the creator_id column - but in any event, I changed it to remove everything other than requesting_user_id() and if i set RLS to true, I can still make an event, and the creator_id still populates with the same user id value (which is the clerk id).

If I try to add RLS as follows:

Use options above to edit

alter policy "users can edit their own proposals"

on "public"."events"

to public

using (

7
(requesting_user_id() = creator_id)

);

(noting that I type line 7 without the parenthesis but when i go back in to check it saved, they appear as added back)

then I get an RLS violation. I am sure the clerk_id is the creator_id and i am sure I am logged in through clerk.

[GaryAustin1]

Your RLS looks correct to me.
Your step 6 code has session test in it. That does not appear in the guide.

This part makes no sense:

Why are you calling supabase.auth.getUser() when you are not using supabase auth?
That will not work with Clerk only auth and might also wipe out the needed Authorization header (not sure).
It could be because your getUser has to fail if you did not sign in with Supabase Auth that your session is null so your step 6 code never sets a the token in the Authorization header.

I'm about done for the night. You might be better off starting a thread in Supabase Discord. There are more users there and it is much easier to share code and bounce back and forth than here. It is easy to solve clear cut problems here, but not ones that need a lot of back and forth as code.

The Clerk guide works, I've helped a dozen users using it.

[charkhaniakash]

@MincePie Summery for this is
| Plan | Can use Clerk JWT for RLS? | Can configure JWT settings? | RLS with Clerk |

| Free | ❌ | ❌ | Not possible |
| Team/Pro | ✅ | ✅ | Fully works |

besause You see here in this image , we need to Configure Supabase to Accept Clerk JWTs , but this option we only seen in pro version

Thanks

[GaryAustin1]

On a Free instance.

[charkhaniakash]

Yes you can still add Provider but setting option is disabled

[GaryAustin1]

What setting option is disabled?
The advanced setting screen your show has two options and neither is about 3rd party Auth.

My understanding is 3rd party auth works with Free and it is documented in the pricing page. I can't check as I don't use a 3rd party provider.

If it is not working in Free then you should generate an issue in supabase/supabase issues.

[solvionsolutions]

The problem is that auth.uid() casts the JWT sub to a uuid, but Clerk user IDs (user_2abc…) aren't UUIDs — so it errors or comes back null. Don't try to map it onto your uuid primary key.

Two things fix it:

Use Clerk's native Supabase integration (the old JWT-template method was deprecated in April 2025). In Supabase: Authentication → Third-Party Auth → add Clerk. That makes Supabase trust Clerk's token and adds the role: authenticated claim the policies need.
Store the Clerk ID as a text column and compare it to auth.jwt() ->> 'sub' (as text, never cast to uuid):
If queries come back empty with no error, the token's missing the role: authenticated claim — check with select auth.jwt() ->> 'role';.

Full breakdown with the client setup + that role-claim gotcha: https://www.guardlayer.io/blog/clerk-supabase-rls