Supabase in production: the choices its own skills cannot make

Supabase's own agent skills know the API. They cannot decide how your product uses it: who holds a key, what RLS is for, how a migration reaches production, and whether a push applies one. Those decisions are here, with the incident that produced each.

They were learned on Next.js (App Router) + Supabase Postgres + Clerk + Netlify, across several products. Among them were a live Q&A product with an anonymous audience and a monitoring product that runs Workers and worker boxes beside the app, named here only by kind. Where Supabase's defaults or quickstarts contradict this skill, this skill wins.

The principles carry to any hosted Postgres. Under them:

• each runtime holds its own credential, and only the app server holds the one that bypasses RLS;
• isolation lives in code you can test;
• schema is files, applied to a target you state rather than one a config file remembers;
• a deploy and a migration are two separate acts unless an integration joins them, so know which you have.

Supabase's own skills: get them, prefer them for the API

• supabase covers any Supabase task: client libraries, auth, the CLI, the MCP server, schema changes. supabase-postgres-best-practices covers anything that lives in Postgres: tables, types, indexes, functions, migrations, RLS. Both come from the GitHub repository supabase/agent-skills.
• Install: npx skills add supabase/agent-skills. This uses the open skills CLI, and the Supabase dashboard's Connect → MCP page offers the same command (observed 2026-08). Vendor them into the product's skills folder (.claude/skills/ or .agents/skills/) so they load whenever Supabase is touched. Prefer them over training-era memory of the API.
• Pin them. A skills-lock.json at the repository root records each skill's source repository, its path and a content hash. npx skills update refreshes them on purpose, never by surprise.
• What they will offer that this skill refuses: @supabase/ssr and a key in the browser; RLS policies written to match an access model; applying a migration through the MCP; schema edits in the dashboard; supabase link to whichever project you are working on.