Auth that doesn't break in Safari. RLS that actually denies. Performance fixes from real launches. Written from a year of shipping with these tools.
Everything you need to build production-ready full-stack apps with Next.js 15 and Supabase — authentication, RLS, deployments, performance, and architecture decisions.
Field-tested fixes for the Supabase errors that actually waste your time: RLS silent failures, session persistence, slow queries, realtime gotchas, and auth redirects.
Practical n8n automation guides built from actual client work — CRM lead capture, client reporting, Zapier migration, silent failure debugging, and self-hosted AI with Ollama.
PostgreSQL error messages and query patterns you hit running Postgres in production — whether you connect through psql directly or through Supabase, the underlying database is the same.
The TypeScript compiler errors (TS2322, TS2305, TS7016, TS2564 and friends) you actually hit building Next.js apps, with the fix and the type-system reasoning behind it.
Paste your error, get the diagnosis and the fix — nothing leaves your browser.
Run your policies against real Postgres, as four identities at once.
Not a pattern matcher — it executes your SQL and reports what Postgres actually returned.
Open the playgroundOur three most recent articles. No curve, no algorithm — just dates.
When Firestore throws 'Expected first argument to collection()', it's almost always a missing Firestore instance. Learn the exact fix for Next.js and v9 modular SDK.
Next.js 16 build crashes prerendering the internal /_not-found route. Here are the three actual causes behind it, how to tell which one is yours, and the fix for each.
Next.js 16 replaced implicit caching with the explicit "use cache" directive. Here is what actually breaks when you flip cacheComponents on, and how to fix it without reverting.
Find stories that matter to you.
TypeScript 6.0 shipped in March 2026 with strict mode on by default and several legacy options removed. Here is what actually breaks migrating a real Next.js + Supabase codebase, in the order to fix it.
Both of these will authenticate a user perfectly well, so comparing sign-in methods is a waste of your afternoon. The decision that actually costs you later is where authorisation is enforced. Supabase Auth puts a user id inside the database so policies can use it; Better Auth puts sessions in a table you own and leaves enforcement to your application. Pick the wrong one and you are rewriting your security model, not swapping a library.
`AuthSessionMissingError: Auth session missing!` is not a bug report — it is Supabase telling you, accurately, that the client you called had no session to work with. The hard part is that the same message covers a signed-out user, a server client that never received your cookies, a middleware that forgot to forward them, and a `getUser()` call that fired before the session was restored. Each has a different fix.
Your app loads, the session arrives, and then every Supabase call after it hangs forever. No error, no rejected promise, no network request — the query simply never returns and the loading spinner stays up until someone reloads the page. If you fetch a profile inside your `onAuthStateChange` callback, this is a documented deadlock in supabase-js, and the fix is one line.
A view over `auth.users`, a policy that joins it, or a client query against it all fail the same way: `ERROR: 42501: permission denied for schema auth`. It is not a missing GRANT you forgot — Supabase keeps the `auth` schema out of reach of the API roles deliberately, and granting your way in is the one fix you should not apply. The supported route is a security definer function.
Every RLS leak I have seen shipped the same way: the policy was tested in a context that does not enforce it. The Supabase SQL editor runs as a privileged role, the service key carries `BYPASSRLS`, and the table owner is exempt from its own policies unless you say otherwise. Three green checks, zero enforcement. This is the procedure that actually tests a policy — plus the two Postgres flags that decide whether your test means anything.
The Firestore error "PERMISSION_DENIED: Missing or insufficient permissions" never tells you which rule rejected you. Here is how to find out — and the seven causes that account for almost every occurrence.
The @/* alias fails in four different places for four different reasons. A 60-second checklist, then a fix per resolver: Next.js build, TS server, Jest and ESLint.
The error fires when psql reaches the password prompt but the password PostgreSQL has on file does not match what you typed — common after switching auth methods, restoring from a dump, or using Docker with a baked-in password. Fix it by setting a password with ALTER USER inside psql, then verifying pg_hba.conf has scram-sha-256 (not md5 or trust) for the line matching your connection.
Mostly RLS gotchas, Next.js cache debugging notes, and the one Supabase setting that bit me last month. Written like a friend would tell you, not like a marketing team.
