← All errors

Supabase: new row violates row-level security policy

new row violates row-level security policy for table "profiles"

In one sentence: Supabase's security rules (RLS) blocked your insert or update because no policy allows it.

What it means

Row Level Security (RLS) is Supabase's per-row permission system. Once RLS is enabled on a table, every action (select, insert, update, delete) is denied unless a policy explicitly allows it.

On reads, RLS doesn't error; it just returns an empty list. That's why "my query returns nothing" is often the same problem.

Common causes

• RLS is on but there's no INSERT (or UPDATE) policy for the table.
• The user isn't logged in, so `auth.uid()` is null and the policy fails.
• The row you insert has `user_id` that doesn't match `auth.uid()`, or is missing entirely.
• An UPDATE also needs a SELECT policy, because Postgres has to read the row before it can update it.

How to fix it

1. In the Supabase dashboard, open Authentication → Policies (or the SQL editor) and add policies for the actions you need.
2. Make sure the row's owner column is set to the logged-in user's id (either in your insert or with a column default of `auth.uid()`).
3. Confirm the request is made with the user's session, not the anon key with no login.
4. Don't fix this by turning RLS off or putting the service_role key in your frontend. That exposes every row to anyone.

alter table profiles enable row level security;

create policy "Users can read own profile" on profiles
  for select using (auth.uid() = user_id);

create policy "Users can insert own profile" on profiles
  for insert with check (auth.uid() = user_id);

create policy "Users can update own profile" on profiles
  for update using (auth.uid() = user_id) with check (auth.uid() = user_id);

Prompt to paste into your AI tool

Supabase returns 'new row violates row-level security policy'. Add the minimal RLS policies so a logged-in user can select/insert/update only their own rows (user_id = auth.uid()), make sure inserts set user_id, and do not disable RLS or use the service role key in client code.

Related errors

• TypeError: Cannot read properties of undefined
• CORS error: blocked by CORS policy
• Hydration failed: server HTML didn't match the client (Next.js)
• Module not found: Can't resolve '...'