# How to Connect Supabase to a FluxNative App

FluxNative team · 2026-09-23

Connect Supabase in four simple steps: copy your values, save them in Connections, describe your data in plain words, and check that each person only sees their own data.

Supabase gives your app a database, sign-in and file storage. FluxNative connects to it, so the assistant can do the setup work for you.

You create the Supabase project and save its values once. The assistant creates the tables, the security rules and the sign-in screens. This guide walks through each step in plain words.

## Key takeaways

- You need the project URL, plus a personal access token or the project's two API keys.
- Save them in Connections, under Backend, then Supabase. Never paste them into the chat.
- With the token, the assistant writes the tables, the security rules and the functions for you. You describe your data in plain words.
- Test with two accounts to make sure each person only sees their own data.

![You save your Supabase values in Connections once; the assistant uses the connection to build tables, security rules, sign-in and functions in Supabase; your app then reads and writes data in Supabase.](https://fluxnative.app/content/assets/29df0e7c-96be-4e83-86ae-05402373cce4/lg)

## Step 1: Copy your values from Supabase

Create a project in Supabase if you don't have one yet. Then copy:

1. **Project URL.** In the Supabase dashboard, open your project, choose **Connect**, and copy the URL. It looks like `https://abcdefghijklmnopqrst.supabase.co`.
2. **A personal access token.** Click your avatar, open **Account preferences**, then **Access Tokens**, and generate a token. Name it after FluxNative, choose an expiry, and copy it right away, because Supabase shows it only once. It starts with `sbp_`.

The token is optional, but it's what lets the assistant do the setup for you: run SQL and migrations, deploy Edge Functions and change Auth settings. It also fills in the project's two API keys. A token reaches every project in your Supabase account, so make one just for FluxNative.

Rather not use a token? Copy the **anon** key and the **service role** key from **Project Settings**, then **API Keys**. That's enough to connect, but the assistant can't run SQL, so it can't create tables or rules for you.

FluxNative shows the same steps under **Where to find your Supabase values**.

![The Supabase help in FluxNative's Connections window: copy the Project URL from Connect, copy the anon and service role keys from API Keys, and an optional personal access token that adds SQL, Edge Function deploys and Auth settings.](https://fluxnative.app/content/assets/d615c71f-6c6d-409c-af7e-bc48c2e3ac5b/lg)

## Step 2: Save them in Connections

In your FluxNative project, click **Server** in the project bar to open Connections. Open the **Backend** tab and choose **Supabase**. Paste the URL and the token, or the two keys, then press **Save and test**.

The values are stored encrypted on the server. The assistant uses the connection to finish the setup, and your app only gets the public values.

![The Supabase form in Connections: Project URL, an optional personal access token, the anon key and the service role key, and the Save and test button.](https://fluxnative.app/content/assets/670829e1-c6d6-432a-a989-8d190552ba26/lg)

Never paste a key or token into the chat, not even as an example. If the assistant needs a value that is missing, it asks you to add it in Connections.

## Step 3: Describe your data in plain words

Now tell the assistant what the app should store and who may see it. You don't need to write SQL. For example:

`Supabase is connected. Add email sign-in. Store each member's bookings in a table with the class, the time and the member. Members can only read and cancel their own bookings.`

With the access token saved, the assistant creates the table, turns on row-level security, writes the rules and updates the screens.

**What is row-level security?** It's a rule that lives inside the database. Each time the app asks for data, the database checks who is asking and returns only the rows that belong to them. So even if someone skips your app and calls the database directly, they can't read other people's data.

![Anna's phone asks the bookings table for data. Row-level security returns only Anna's two bookings; Ben's rows stay locked.](https://fluxnative.app/content/assets/edc12c29-6df6-4744-b017-0f737c738123/lg)

## Step 4: Test with two accounts

A hidden button is not security. The database itself has to refuse what the screens don't show. The easiest way to check is with two test accounts:

1. Create two accounts, A and B.
2. Sign in as A and add something private, like a booking.
3. Sign in as B and try to see or change A's booking.
4. B should get nothing. If B can see it, ask the assistant to fix the rule for that table.

While you're there, also try sign-up, sign-in, a wrong password, a password reset and sign-out.

![Account A adds a private booking. Account B tries to read it and is refused.](https://fluxnative.app/content/assets/7792e76b-743e-4c7c-a794-9a12a650c040/lg)

## When a function needs another key

Sometimes your backend has to call another service, like an email provider. That code runs in a Supabase Edge Function, not in the app. Add the service's key under **API keys & secrets** in Connections: a name the way your code reads it, like `RESEND_API_KEY`, the value, and one line saying what it's for.

The value is stored encrypted and never shown again. The assistant only sees the name and that line, and your functions get the key by name, so it never ships inside your app.

![The API keys & secrets tab in Connections, with a name such as OPENAI_API_KEY, a value field, and a line saying what the key is for.](https://fluxnative.app/content/assets/e8f5b0c7-6152-461f-8f52-5648816c9fc5/lg)

## Frequently asked questions

### Do I need to write SQL myself?

No. Once Supabase is connected, the assistant writes the SQL, the row-level security rules and the Edge Functions. You describe what you need in plain words, then test the result.

### Can I use the anon key instead of an access token?

Yes. Paste the anon key and the service role key from Project Settings, then API Keys. The assistant can then manage sign-in users and storage and call your Edge Functions, but it can't run SQL or deploy functions for you.

### Is there a faster way to start?

Yes. Templates such as BiteRush, Forge Fitness and Mosaic already include Supabase sign-up, login and password reset. Fork one and connect your own Supabase project.

## Keep exploring

- **[Supabase setup](https://fluxnative.app/docs/supabase)** — The exact values to paste, with example prompts.
- **[Connections](https://fluxnative.app/docs/connections)** — How backends, payments and secret keys fit together.
- **[BiteRush Food Delivery App](https://fluxnative.app/templates/yumquick-food-delivery)** — A working Supabase app with sign-in, menu, cart and orders.

---

Connect Supabase to a FluxNative app in four steps. The assistant builds the tables, row-level security and sign-in for you, and keys stay out of chat.

Page: https://fluxnative.app/blog/connect-supabase-to-a-fluxnative-app