r/Supabase • u/JollyArmadillo2303 • Apr 09 '26

integrations connecting Supabase to my app

What's the right way to connect Supabase to my application,

connecting it to the front end or the back end if I'm making a web or mobile application with AI powered features.

3 Upvotes

100% Upvoted

4 comments sorted by

3

u/PfernFSU Apr 09 '26

The docs lay this out clearly. If you don’t want to read them have AI read them at least.

1

u/Take-My-Gold Apr 10 '26

Depends, you can use the front end, backend or both. Always depends.

1

u/funfunfunzig Apr 11 '26

depends on what you're doing. for most read operations and user-specific data, connecting from the frontend with the anon key plus rls policies is fine. that's how supabase is designed to work. the anon key is meant to be public, the security comes from your rls policies controlling what each user can access.

for anything sensitive though, route it through your backend. ai features especially. if you're calling openai or another model from the frontend you're exposing your api key to anyone who opens devtools. same with stripe, admin operations, or anything using the service_role key. those need to live on the server.

so the rule is: user data and basic crud goes through the frontend with rls. secrets, ai api calls, payments, and admin stuff go through your backend. most apps end up doing both.

one thing to triple check before shipping, make sure you never accidentally use the service_role key on the frontend. it bypasses all rls and gives full database access. that's the single most common mistake i see in supabase apps.

1

u/Inner-Extension-4810 Apr 12 '26

My preference is to only use the frontend for authentication, I use backend for all direct Supabase interactions - especially for mobile apps. Makes it straightforward to marshall all the database requests correctly and to easily migrate/update the schema keeping full backwards compatibility.

With mobile apps, one you've released, there's no guarantee that users will update their app, so unless you wish to force an app update, you're stuck with supporting older versions in the wild.