{"id":15217,"date":"2026-10-01T03:37:41","date_gmt":"2026-10-01T03:37:41","guid":{"rendered":"https:\/\/playgama.com\/blog\/?p=15217"},"modified":"2026-10-01T03:37:41","modified_gmt":"2026-10-01T03:37:41","slug":"how-to-use-supabase-rls-and-schema-for-browser-game-saves","status":"publish","type":"post","link":"https:\/\/playgama.com\/blog\/business-faqs\/how-to-use-supabase-rls-and-schema-for-browser-game-saves\/","title":{"rendered":"How to use Supabase RLS and schema for browser game saves?"},"content":{"rendered":"

Put saves in a public table with an owner column, enable Row Level Security on it, and write a policy that only lets each authenticated user (or anonymous auth user) read and write their own rows. Query it from the browser with a publishable key, never a service key.<\/strong><\/p>\n

At a glance<\/h2>\n\n\n\n\n\n\n\n
Fact<\/th>\nValue<\/th>\nSource<\/th>\n<\/tr>\n<\/thead>\n
Table without RLS is fully open<\/td>\nreadable\/writable by any grant holder<\/td>\nsupabase.com<\/a><\/td>\n<\/tr>\n
RLS blocks all access until policies exist<\/td>\nno data via publishable key<\/td>\nsupabase.com<\/a><\/td>\n<\/tr>\n
Anonymous auth users get row-level access<\/td>\nvia anonymous auth<\/td>\nsupabase.com<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Design one saves<\/code> table in the public<\/code> schema with a user_id<\/code> column referencing auth.users<\/code>, then enable Row Level Security on it and add a policy that only lets a role read or write rows where user_id = auth.uid()<\/code>. A table in an exposed schema without RLS is readable and writable by any role with a grant on it, and once RLS is enabled no data is reachable through the Data API with a publishable key until you write policies (Supabase RLS docs<\/a>). Combine RLS with Supabase Auth so the browser-to-database path is scoped per user rather than trusting the client.<\/p>\n

If you prefer not to manage backend saves, the Playgama Bridge Storage module<\/a> automatically persists data across platforms, including cloud saves.<\/p>\n

What to check before shipping<\/h2>\n