Documentation Database (bring your own Supabase)

Database (bring your own Supabase)

CloudCode doesn't provision a database, auth, storage or serverless functions for the apps you build. For a backend, connect your own Supabase project (the free tier is enough to start). You own the data and can manage it from the Supabase dashboard whether or not you keep using CloudCode. The agent writes the client code, queries and migrations for you.

1
Create a Supabase project
In the Supabase dashboard, create a project, then copy the Project URL and the anon (public) key from its API settings.
2
Add the client
Ask the agent: "Add @supabase/supabase-js and create src/lib/supabase.ts that exports a client using my project URL and anon key." The agent adds the package to package.json, and the dev preview loads it from there. Use a config module rather than import.meta.env, because neither the dev preview nor one-click deploys inject environment variables.
3
Design the schema
Describe your tables in plain language. The agent's migration tool writes SQL to supabase/migrations/<timestamp>_<name>.sql in your project. It doesn't run the migration.
4
Apply the migration
Review the SQL, then run it in the Supabase SQL editor. Alternatively, push the project to GitHub and run supabase db push with the Supabase CLI on your machine or in CI.
typescript
// src/lib/supabase.ts
import { createClient } from "@supabase/supabase-js";

const SUPABASE_URL = "https://YOUR-PROJECT.supabase.co";
const SUPABASE_ANON_KEY = "YOUR-ANON-KEY"; // public by design; RLS protects your data

export const supabase = createClient(SUPABASE_URL, SUPABASE_ANON_KEY);
typescript
import { supabase } from "@/lib/supabase";

// Select
const { data, error } = await supabase
  .from("posts")
  .select("*")
  .eq("user_id", userId);

// Insert
await supabase.from("posts").insert({ title: "Hello world", user_id: userId });

// Realtime subscription
supabase
  .channel("posts")
  .on("postgres_changes", { event: "*", schema: "public", table: "posts" }, (payload) => {
    console.log("Change received:", payload);
  })
  .subscribe();

Row-level security (RLS)

Ask the agent to enable RLS on every table and write policies that match auth.uid() to an owner column. Then check the generated SQL before you apply it, because RLS is the only thing protecting rows from anyone holding your anon key.

Warning
Never put the service_role key in frontend code. It bypasses RLS and belongs only in server-side code such as edge-function secrets.