(also no clue how to "add a role to the jwt")

Are you using your jwt with the client now?

I've got the client created with the anon key. I've tried enabling RLS and adding policies to allow anon to read, but no dice.

https://supabase.com/docs/learn/auth-deep-dive/auth-deep-dive-jwts Shows the role being added to a jwt, but if you are using the anon key without signing in that might be enough. I need to find the discussion here or github where a user had an issue with custom jwt and needed to add role. BUT it should work with anon key only. Do you have a websocket running

Gimme a sec, i'll get you a snippet and some better screenshots

If unauthorized then that sounds like the error with custom jwt and realtime the user had. I'll look for that thread.

js
supabase
  .from('*')
  .on('*', console.log)
  .subscribe();

Basic sub, then when sending a message which inserts into a table that I have replication enabled for I get this error. I'm only doing anon auth for the supabase client here. But that should work since I have this policy

https://github.com/supabase/supabase/issues/7440 Is the outcome of a discussion here I was in.

So far, no, because it looked like the anon should be able to read with the policies we have in place

I agree, I would think anon key would work IF you don't set the jwt also with your own

My instantiation is just:

const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL;
const supabaseAnonKey = process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY;
export const supabase = createClient(supabaseUrl, supabaseAnonKey);

Can you see the actual websocket try to start up?

With the two values coming from these two boxes

I'm a bit confused on your screen showing the error. The unauthorized is coming back with an actual insert event?

yes

Does realtime.subscriptions have entries when you have a connection?

Well that message had an api key oops

You don't need to repost it

Well anyways yeah, earlier my ws failed too. sadly, I don't recall what fixed that.

I'm going to suggest you either contact SB support or generate an issue in github realtime. We could go around in circles on this without understanding if something is wrong with your instance. One of the SB team on realtime may need to look at this. The thing I don't get is if you are not setting your jwt in the supabase client with a setAuth or some such thing then not sure how your jwt is involved at all.

Doing supabase.getSubscriptions() returns:

This is an anon realtime start up and the first heartbeat.

Yep

So if user token is anon key, then it is something on the server side. I got nothing else for you at the moment.

the insert is being done via our api which uses prismajs

I think the problem might be your prisma setting up the tables. I don't know much about it, but I believe you have to set up a number of user/role grants as part of the process. That would match with realtime generating a 401 when it reads the table as user anon. A call from supabase.from.select probably won't work either without those grants. No camera and about to head out, but there might be documentation already on the grants needed for prisma, or at least a github issue with them