A have a fundamental (noob...?) question regarding using Supabase Auth / RLS with SvelteKit in **SSG **(Static Site Generation) mode, deploying to Vercel. (https://kit.svelte.dev/docs/appendix#ssg) Our new SvelteKit project will have three types of pages: - Purely static content (blog posts etc.) - Mainly static content, but some interactivity for "anon" visitors (e.g. quote calculation form) - Dashboards (accounts) for authenticated users (vendors, clients, admins) SEO is hugely important to us, so I want the pages with static content to be super fast. Also we only update content every two weeks. So I plan to use SvelteKit SSG and host our website/app on Vercel. I've spent a few days messing around with Supabase Auth, RLS, SvelteKit hooks, $session, Page Endpoints,

load

function (which I've read will be deprecated). I like the SvelteKit Page Endpoints idea and from what I understood they run server-side and will also work with Vercel, which converts them to Serverless Functions. Questions: 1) For my config / deployment / hosting scenario, can I just use Supabase Auth (with RLS) in Page Endpoints (or any Endpoints), or do I need something like the auth-helper for SvelteKit (thanks for @silentworks for mentioning it), to pass on the user auth data / session to the "server-side" (endpoints), where the Supabase JS client will fetch data from the DB? 2) If I want to avoid using any additional utils / packages like this auth-helper, or coding something around auth in SvelteKit (hooks, session etc.) at all, and want to use Supabase JS client "out of the box", what are my options? Only to use it client-side (e.g. in

onMount

...)? Naturally UX and security are most important to me, so if I need to do some extra coding, that's not a problem, but I want to understand this whole shebang and add/code only what is really necessary for our project. Any guidance on the above will be greatly appreciated!

Hello @Waldemar! This thread has been automatically created from your message in #843999948717555735 a few seconds ago. We have already mentioned the @User so that they can see your message and help you as soon as possible! Want to unsubscribe from this thread? Right-click the thread in Discord (or use the ``...`` menu) and select "Leave Thread" to unsubscribe from future updates. Want to change the title? Use the ``/title`` command! We have solved your problem? Click the button below to archive it.

Oh man there is a lot in here. The Auth helpers are mainly for SSR use so I'm not sure how well it will fit in your SSG use case as I haven't tested it in such use case myself. You can use the

supabase-js

library in the client side part of your app. From a security perspective, as long as you have your RLS policies in place then it should be fine in this case. Also for SSG you can use the

supabase-js

library inside of any part of the script block and not only onMount, remember onMount only runs when a component is mounted.

> Oh man there is a lot in here I always make sure to use up the Discord's message length limit 😁 but, yeah, couldn't explain it any shorter. > The Auth helpers are mainly for SSR well, I understand prerendering is a type of SSR, because it also executes the page endpoints to generate static pages. Also the endpoints should be converted to Serverless Functions on Vercel (..."serverless" is strange name... it will be running on Vercel's servers, and not client. as far as I understand). The reason why I'm trying to make

supabase-js

work in server-side code (i.e. endpoints), is because even though the RLS will kick in when I use

supabase-js

client-side, our RBAC is quite complex, so the RLS wouldn't work or become very complex and if looks like I would need to code some RBAC logic in SvelteKit and doing it on the server-side code sounds safer... To get back to auth-helpers: one thing for example I don't understand / like, is that I need to use

withApiAuth

, like shown here: https://github.com/supabase-community/auth-helpers/tree/main/packages/sveltekit#server-side-data-fetching-with-rls Why can't I just use the client normally, like for example

await supabase.from('cities').select()

?