Role-Based Access with RLS and Custom Claims
Build advanced Row-Level Security policies that grant different access by user role using JWT claims and helper functions.
Role-Based Access with RLS and Custom Claims is a free Supabase Backend as a Service lesson on CoddyKit — lesson 3 of 3. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Supabase Backend as a Service learning path, one of 3 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Beyond Owner-Only Policies
Basic RLS often checks auth.uid() for ownership. Real apps also need role-based rules, like admins seeing everything and editors seeing more than viewers.
Where Roles Live
You can store roles in a column on a profiles table, or embed them as custom claims in the user's JWT for fast, joinless checks.
Reading the JWT in SQL
Supabase exposes the JWT via auth.jwt(). You can read custom claims from it.
-- returns the 'user_role' claim as text
select auth.jwt() ->> 'user_role';A Role Helper Function
Wrap the claim read in a helper so policies stay readable.
create or replace function current_role_name()
returns text
language sql stable
as 'select coalesce(auth.jwt() ->> ''user_role'', ''viewer'')';Admin-Sees-All Policy
Grant admins unrestricted read access while others are limited.
create policy admin_read on documents
for select
using (current_role_name() = 'admin');Combining Ownership and Role
Policies can OR conditions: a user sees a row if they own it OR they are an admin.
create policy read_own_or_admin on documents
for select
using (
owner_id = auth.uid()
or current_role_name() = 'admin'
);Separate Policies per Action
Define distinct policies for SELECT, INSERT, UPDATE, DELETE so each action has the right rule, for example editors can update but viewers cannot.
Modeling a Role Hierarchy
Map roles to permission levels so you can compare numerically.
function level(role) {
return { viewer: 1, editor: 2, admin: 3 }[role] || 0;
}
console.log(level('editor') >= level('viewer'));Setting Custom Claims
Custom claims are added to the JWT via an auth hook or by a trusted server using the admin API. Never let clients set their own role.
Security Reminders
Always keep RLS enabled on the table. Helper functions should be stable, and role logic must never trust client-supplied values directly.
Putting It Together
Combine ownership checks with role claims read from the JWT to express rich, secure access rules entirely in the database.
Quick Check
Test your understanding of role-based RLS.
Recap
You built role-based RLS using auth.jwt() custom claims, helper functions, combined ownership-or-role policies, per-action rules, and learned to set roles only on a trusted server.
Frequently asked questions
Is the “Role-Based Access with RLS and Custom Claims” lesson free?
Yes — the full text of “Role-Based Access with RLS and Custom Claims” is free to read here on the web, and the Supabase Backend as a Service course includes 3 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Supabase Backend as a Service course, upgrade to CoddyKit PRO.
What will I learn in “Role-Based Access with RLS and Custom Claims”?
Build advanced Row-Level Security policies that grant different access by user role using JWT claims and helper functions. You practise Supabase Backend as a Service with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Supabase Backend as a Service?
No prior experience is required. Supabase Backend as a Service on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 3, so you can start here or from the beginning and move at your own pace.
How long does the “Role-Based Access with RLS and Custom Claims” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Supabase Backend as a Service lesson?
Yes. Every Supabase Backend as a Service lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Introduction to RLS Policies
- Testing and Debugging RLS
- Role-Based Access with RLS and Custom Claims