How to Connect Supabase with the PostgREST API

Every Supabase project exposes its REST API at https://<project-ref>.supabase.co/rest/v1/. Open your Supabase Dashboard, go to Settings → API, and copy the Project URL and the anon (public) key. The anon key is safe to use in client-side code because it maps to the Postgres anon role, which is restricted by your RLS policies. For server-side operations that need to bypass RLS, use the service_role key — but never expose it in client code.

1# Your API base URL
2https://xyzcompany.supabase.co/rest/v1/
3
4# Required headers for every request
5apikey: your-anon-key-here
6Authorization: Bearer your-anon-key-here

To read data, send a GET request to your API URL followed by the table name. PostgREST maps GET requests to SQL SELECT statements. You can add query parameters for filtering: ?column_name=eq.value for equality, ?select=col1,col2 for column selection, and ?order=column.asc for sorting. The response is always a JSON array of objects. If RLS is enabled and no SELECT policy exists, you will get an empty array — not an error.

1# Fetch all rows from the 'todos' table
2curl 'https://xyzcompany.supabase.co/rest/v1/todos?select=*' \
3  -H "apikey: YOUR_ANON_KEY" \
4  -H "Authorization: Bearer YOUR_ANON_KEY"
5
6# Fetch specific columns with a filter
7curl 'https://xyzcompany.supabase.co/rest/v1/todos?select=id,task,is_complete&is_complete=eq.false' \
8  -H "apikey: YOUR_ANON_KEY" \
9  -H "Authorization: Bearer YOUR_ANON_KEY"
10
11# Order by created_at descending, limit to 10 rows
12curl 'https://xyzcompany.supabase.co/rest/v1/todos?select=*&order=created_at.desc&limit=10' \
13  -H "apikey: YOUR_ANON_KEY" \
14  -H "Authorization: Bearer YOUR_ANON_KEY"

To insert data, send a POST request with a JSON body containing the row data. Set the Content-Type header to application/json. PostgREST maps POST to SQL INSERT. You can insert a single object or an array of objects for bulk inserts. To get the inserted row back in the response, add the header Prefer: return=representation. Remember that RLS INSERT policies must allow the operation, and you also need a SELECT policy if you want the response to include the inserted data.

1# Insert a single row
2curl 'https://xyzcompany.supabase.co/rest/v1/todos' \
3  -X POST \
4  -H "apikey: YOUR_ANON_KEY" \
5  -H "Authorization: Bearer USER_JWT_TOKEN" \
6  -H "Content-Type: application/json" \
7  -H "Prefer: return=representation" \
8  -d '{"task": "Buy groceries", "is_complete": false, "user_id": "uuid-here"}'
9
10# Bulk insert multiple rows
11curl 'https://xyzcompany.supabase.co/rest/v1/todos' \
12  -X POST \
13  -H "apikey: YOUR_ANON_KEY" \
14  -H "Authorization: Bearer USER_JWT_TOKEN" \
15  -H "Content-Type: application/json" \
16  -H "Prefer: return=representation" \
17  -d '[{"task": "Task 1"}, {"task": "Task 2"}]'

Use PATCH for updates and DELETE for deletions. Both require query parameters to identify which rows to affect — without filters, PostgREST will refuse the operation for safety. Use the same filter syntax as SELECT: ?id=eq.1 for a specific row, or combine multiple filters. RLS UPDATE policies must allow the operation, and UPDATE also requires a matching SELECT policy. RLS DELETE policies control which rows can be removed.

1# Update a specific row
2curl 'https://xyzcompany.supabase.co/rest/v1/todos?id=eq.1' \
3  -X PATCH \
4  -H "apikey: YOUR_ANON_KEY" \
5  -H "Authorization: Bearer USER_JWT_TOKEN" \
6  -H "Content-Type: application/json" \
7  -H "Prefer: return=representation" \
8  -d '{"is_complete": true}'
9
10# Delete a specific row
11curl 'https://xyzcompany.supabase.co/rest/v1/todos?id=eq.1' \
12  -X DELETE \
13  -H "apikey: YOUR_ANON_KEY" \
14  -H "Authorization: Bearer USER_JWT_TOKEN" \
15  -H "Prefer: return=representation"

PostgREST also exposes PostgreSQL functions as RPC endpoints. Send a POST request to /rest/v1/rpc/function_name with a JSON body for the parameters. This is how supabase.rpc() works under the hood. Functions must be in the public schema and have EXECUTE permission granted to the calling role (anon or authenticated). Security definer functions bypass RLS, while security invoker functions run with the caller's permissions.

1# Call a database function
2curl 'https://xyzcompany.supabase.co/rest/v1/rpc/get_todos_by_status' \
3  -X POST \
4  -H "apikey: YOUR_ANON_KEY" \
5  -H "Authorization: Bearer USER_JWT_TOKEN" \
6  -H "Content-Type: application/json" \
7  -d '{"status_filter": "pending"}'

While the Supabase JS client is convenient, you can call the REST API directly using fetch or any HTTP library. This is useful in environments where you cannot install npm packages, or when you need fine-grained control over requests. Pass the user's JWT token in the Authorization header for authenticated requests. The API behaves identically whether called via the JS client or direct HTTP — the same RLS policies apply.

1const SUPABASE_URL = 'https://xyzcompany.supabase.co';
2const SUPABASE_ANON_KEY = 'your-anon-key';
3
4// Fetch todos with filters
5const response = await fetch(
6  `${SUPABASE_URL}/rest/v1/todos?select=id,task,is_complete&is_complete=eq.false&order=created_at.desc`,
7  {
8    headers: {
9      'apikey': SUPABASE_ANON_KEY,
10      'Authorization': `Bearer ${SUPABASE_ANON_KEY}`,
11    },
12  }
13);
14const todos = await response.json();