Supabase gives your app a database, sign-in and file storage. FluxNative connects to it, so the assistant can do the setup work for you.

You create the Supabase project and save its values once. The assistant creates the tables, the security rules and the sign-in screens. This guide walks through each step in plain words.

Key takeaways

You need the project URL, plus a personal access token or the project's two API keys.
Save them in Connections, under Backend, then Supabase. Never paste them into the chat.
With the token, the assistant writes the tables, the security rules and the functions for you. You describe your data in plain words.
Test with two accounts to make sure each person only sees their own data.

You save your Supabase values in Connections once; the assistant uses the connection to build tables, security rules, sign-in and functions in Supabase; your app then reads and writes data in Supabase. — You save the connection once. The assistant uses it to build your backend, and your app talks to Supabase directly.

Step 1: Copy your values from Supabase

Create a project in Supabase if you don't have one yet. Then copy:

Project URL. In the Supabase dashboard, open your project, choose Connect, and copy the URL. It looks like https://abcdefghijklmnopqrst.supabase.co.
A personal access token. Click your avatar, open Account preferences, then Access Tokens, and generate a token. Name it after FluxNative, choose an expiry, and copy it right away, because Supabase shows it only once. It starts with sbp_.

The token is optional, but it's what lets the assistant do the setup for you: run SQL and migrations, deploy Edge Functions and change Auth settings. It also fills in the project's two API keys. A token reaches every project in your Supabase account, so make one just for FluxNative.

Rather not use a token? Copy the anon key and the service role key from Project Settings, then API Keys. That's enough to connect, but the assistant can't run SQL, so it can't create tables or rules for you.

FluxNative shows the same steps under Where to find your Supabase values.

The Supabase help in FluxNative's Connections window: copy the Project URL from Connect, copy the anon and service role keys from API Keys, and an optional personal access token that adds SQL, Edge Function deploys and Auth settings. — Connections tells you where each Supabase value lives. The URL and the two keys are enough to connect; a personal access token lets the assistant do the rest.

Step 2: Save them in Connections

In your FluxNative project, click Server in the project bar to open Connections. Open the Backend tab and choose Supabase. Paste the URL and the token, or the two keys, then press Save and test.

The values are stored encrypted on the server. The assistant uses the connection to finish the setup, and your app only gets the public values.

The Supabase form in Connections: Project URL, an optional personal access token, the anon key and the service role key, and the Save and test button. — Backend, then Supabase: paste the URL and either the token or the two keys, then press Save and test.

Never paste a key or token into the chat, not even as an example. If the assistant needs a value that is missing, it asks you to add it in Connections.

Step 3: Describe your data in plain words

Now tell the assistant what the app should store and who may see it. You don't need to write SQL. For example:

Supabase is connected. Add email sign-in. Store each member's bookings in a table with the class, the time and the member. Members can only read and cancel their own bookings.

With the access token saved, the assistant creates the table, turns on row-level security, writes the rules and updates the screens.

What is row-level security? It's a rule that lives inside the database. Each time the app asks for data, the database checks who is asking and returns only the rows that belong to them. So even if someone skips your app and calls the database directly, they can't read other people's data.

Anna's phone asks the bookings table for data. Row-level security returns only Anna's two bookings; Ben's rows stay locked. — Row-level security checks who is asking. Anna gets her own rows, and Ben's rows stay locked, even if someone calls the database directly.

Step 4: Test with two accounts

A hidden button is not security. The database itself has to refuse what the screens don't show. The easiest way to check is with two test accounts:

Create two accounts, A and B.
Sign in as A and add something private, like a booking.
Sign in as B and try to see or change A's booking.
B should get nothing. If B can see it, ask the assistant to fix the rule for that table.

While you're there, also try sign-up, sign-in, a wrong password, a password reset and sign-out.

Account A adds a private booking. Account B tries to read it and is refused. — Create data with one account, then try to reach it with another. The database should refuse.

When a function needs another key

Sometimes your backend has to call another service, like an email provider. That code runs in a Supabase Edge Function, not in the app. Add the service's key under API keys & secrets in Connections: a name the way your code reads it, like RESEND_API_KEY, the value, and one line saying what it's for.

The value is stored encrypted and never shown again. The assistant only sees the name and that line, and your functions get the key by name, so it never ships inside your app.

The API keys & secrets tab in Connections, with a name such as OPENAI_API_KEY, a value field, and a line saying what the key is for. — Keys for other services go under API keys & secrets. Your functions get them by name; the assistant only ever sees the name and one line.

Frequently asked questions

Do I need to write SQL myself?

No. Once Supabase is connected, the assistant writes the SQL, the row-level security rules and the Edge Functions. You describe what you need in plain words, then test the result.

Can I use the anon key instead of an access token?

Yes. Paste the anon key and the service role key from Project Settings, then API Keys. The assistant can then manage sign-in users and storage and call your Edge Functions, but it can't run SQL or deploy functions for you.

Is there a faster way to start?

Yes. Templates such as BiteRush, Forge Fitness and Mosaic already include Supabase sign-up, login and password reset. Fork one and connect your own Supabase project.

Keep exploring

Supabase setup — The exact values to paste, with example prompts.
Connections — How backends, payments and secret keys fit together.
BiteRush Food Delivery App — A working Supabase app with sign-in, menu, cart and orders.

How to Connect Supabase to a FluxNative App