Data API grants

grants writes the complete Data API privileges of the tables and functions in the expose config for anon, authenticated and service_role. Use it when the project doesn't grant new tables through default privileges, or when you want the Data API to reach only the tables you list. Row level security still decides which rows a role sees; a grant decides whether the role reaches the table at all.

better-supabase add grants

export default defineConfig({
  database: {
    expose: {
      customers: ["select", "insert", "update", "delete"],
      "public.pricing_plans": { anon: ["select"], authenticated: ["select"] },
      "search_notes(text, integer)": { execute: ["authenticated"] },
    },
  },
  blocks: ["grants"],
});

Each listed table or function gets exactly the listed privileges, and the rest is revoked. upgrade rewrites the grants when the list changes.

OptionsCopy Anchor Link

blocks: { grants: { options: { fromPolicies: true } } },

The Data API grants guide covers column grants, fromPolicies and the doctor checks.