How to Set Custom User Roles in Supabase

1import { createClient } from '@supabase/supabase-js'
2
3// Server-side only — NEVER use service role key in client code
4const supabaseAdmin = createClient(
5  process.env.SUPABASE_URL!,
6  process.env.SUPABASE_SERVICE_ROLE_KEY!
7)
8
9// Set a user's role to 'admin'
10const { data, error } = await supabaseAdmin.auth.admin.updateUserById(
11  'user-uuid-here',
12  {
13    app_metadata: { role: 'admin' }
14  }
15)
16
17// Set a user's role to 'editor'
18await supabaseAdmin.auth.admin.updateUserById(
19  'another-user-uuid',
20  {
21    app_metadata: { role: 'editor' }
22  }
23)
24
25console.log('Role updated:', data.user.app_metadata)

1-- Function to set default role on signup
2CREATE OR REPLACE FUNCTION public.set_default_role()
3RETURNS trigger
4LANGUAGE plpgsql
5SECURITY DEFINER
6SET search_path = ''
7AS $$
8BEGIN
9  -- Only set if no role exists yet
10  IF NOT (NEW.raw_app_meta_data ? 'role') THEN
11    NEW.raw_app_meta_data = 
12      COALESCE(NEW.raw_app_meta_data, '{}'::jsonb) || '{"role": "viewer"}'::jsonb;
13  END IF;
14  RETURN NEW;
15END;
16$$;
17
18-- Trigger on auth.users insert
19CREATE TRIGGER on_auth_user_created_set_role
20  BEFORE INSERT ON auth.users
21  FOR EACH ROW
22  EXECUTE FUNCTION public.set_default_role();

1import { createClient } from '@supabase/supabase-js'
2
3const supabase = createClient(
4  process.env.NEXT_PUBLIC_SUPABASE_URL!,
5  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
6)
7
8// Read the user's role
9const { data: { user } } = await supabase.auth.getUser()
10const role = user?.app_metadata?.role ?? 'viewer'
11
12console.log('User role:', role) // 'admin', 'editor', or 'viewer'
13
14// Use in React for UI visibility
15function AdminPanel() {
16  const [role, setRole] = useState<string>('viewer')
17
18  useEffect(() => {
19    supabase.auth.getUser().then(({ data: { user } }) => {
20      setRole(user?.app_metadata?.role ?? 'viewer')
21    })
22  }, [])
23
24  if (role !== 'admin') return null
25  return <div>Admin Panel Content</div>
26}

1-- Read the role from JWT app_metadata in an RLS policy
2CREATE POLICY "Only admins can delete" ON articles
3  FOR DELETE TO authenticated
4  USING (
5    (select auth.jwt()->'app_metadata'->>'role') = 'admin'
6  );
7
8-- Allow multiple roles
9CREATE POLICY "Editors and admins can update" ON articles
10  FOR UPDATE TO authenticated
11  USING (
12    (select auth.jwt()->'app_metadata'->>'role') IN ('editor', 'admin')
13  )
14  WITH CHECK (
15    (select auth.jwt()->'app_metadata'->>'role') IN ('editor', 'admin')
16  );
17
18-- Everyone can read, but only published for non-admins
19CREATE POLICY "Read access by role" ON articles
20  FOR SELECT TO authenticated
21  USING (
22    status = 'published'
23    OR (select auth.jwt()->'app_metadata'->>'role') IN ('editor', 'admin')
24  );

1-- Create user_roles table
2CREATE TABLE public.user_roles (
3  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
4  user_id uuid REFERENCES auth.users(id) ON DELETE CASCADE NOT NULL,
5  role text NOT NULL CHECK (role IN ('admin', 'editor', 'viewer')),
6  created_at timestamptz DEFAULT now(),
7  UNIQUE(user_id, role)
8);
9
10-- Index for fast lookups in RLS policies
11CREATE INDEX idx_user_roles_user_id ON user_roles (user_id);
12
13-- Enable RLS on the roles table itself
14ALTER TABLE user_roles ENABLE ROW LEVEL SECURITY;
15
16-- Users can read their own roles
17CREATE POLICY "Read own roles" ON user_roles
18  FOR SELECT TO authenticated
19  USING ((select auth.uid()) = user_id);
20
21-- Insert a role
22INSERT INTO user_roles (user_id, role)
23VALUES ('user-uuid', 'editor');