FREE TOOL
Supabase RLS policy generator: copy-paste SQL for each role
Updated
Pick who can read and who can change rows, and copy the SQL. It turns on row level security first, then grants the roles your app uses, then adds the policies. Since Supabase’s 30 October 2026 change, new public tables need these grants before the API can reach them.
Runs in your browser. Nothing you type is sent to us, and no Supabase key is needed.
1. Your table
2. Who may read the rows
Anyone with your publishable (anon) key will be able to read every row of this table. Your publishable key is in your app’s front end. Choose this only for data that is meant to be public.
3. Who may add, change or delete rows
4. Your SQL
Run it in the SQL Editor of your project, or put it in the migration that creates the table. Then test signed out and as one test user, as described in the 42501 guide.
Read more
- Supabase: row level security
- Supabase changelog: tables not exposed automatically
- Supabase “permission denied for table” (42501)
- Data won’t save? Row level security
- Fix 42501: make the GRANT for your table
FAQ
Should I just run grant select to anon?
Only if signed-out visitors really need to read that table, and only with row level security turned on and a policy in place. With row level security off, the anon grant lets anyone with your publishable key read every row.
Is 42501 a row level security error?
It can be either. A missing grant gives 42501 before any policy runs. Row level security also returns 42501 when it blocks an insert or update. Check the grants first, then the policies.
Will my old tables break?
No. Existing tables keep their current grants and stay reachable. Only tables created after the change need explicit grants.
Is what I type sent to VibeFix?
No. The SQL is built in your browser by a script on this page.
Fixed in your code, then tested live.
App broke after you published it? Our AI agent fixes it in your code, then tests your live app again so you see the result yourself. The first check is free.
This tool writes SQL in the form our 42501 guide uses, checked against Supabase’s docs. It does not connect to your project and cannot know what your app needs. Read the SQL before you run it.
VibeFix is independent. Supabase is a trademark of its owner.