https://supabase.com/ logo
Join Discord
Powered by
hey guys, i'm trying to create an app where an adm...
# help
g
hey guys, i'm trying to create an app where an admin can invite other users to their group page from the UI. i see that there's a function https://supabase.com/docs/reference/javascript/auth-api-inviteuserbyemail inviteuserbyemail but i don't understand the note "This function should only be called on a server. Never expose your service_role key in the browser."
c
when you init the supabase client, you provide to it an API key
if you look into your settings in the dashboard
you will see that you have 2 keys
"anon" (a.k.a. "public"), which is OK to put in the code that you ship to the browser
and you also have a "service_role" (a.k.a. "servert") API key
some Supabase client methods, such as inviteUserByEmail(), will ONLY work if you initialized your client with the secret key
and the point here is that you should NEVER do that in code that you ship to the browser, because then users can read your secret key and can do many things against your DB that would NOT be desirable (e.g. they can bypass RLS)
so by "server" they mean any code that IS NOT shipped to the user's browser (this could be a Node.jS server you are running yourself, serverless functions from providers like Firebase/AWS/Vercel), PostgreSQL stored procedures, etc
does this make sense?
g
this makes sense, yes, thank you. i have some complex roles in my db currently and maybe i need to find a better way to authenticate a user to a group
l
I'm currently working on workspace implementation for my project in supabase and I'm doing member invites on the server (API route in Next.js app). 1. I check if the user already exists by email and just add them as a workspace member 2. If the user doesn't exist, then I invite them and add them as a workspace member
g
where exactly in the app is that happening?
thats basically my use case
s
My app is not using NextJS but using SvelteKit and is doing exactly this, you can have a look at its repo here https://github.com/silentworks/waiting-list
The inviteUserByEmail happen inside of this file https://github.com/silentworks/waiting-list/blob/main/src/routes/api/invite.json.js, which is an API route, so server side only.
PreviousNext
Powered by