new row violates row-level security policy
Your report-images bucket exists, but either:
- ❌ Service role key is not in
.env.local, OR - ❌ The bucket wasn't created properly
-
Go to Supabase Dashboard → Your Project → Settings → API
-
Scroll down to Project API keys
-
Copy the
service_rolekey (looks likeeyJhbGc...)
⚠️ NOT theanonkey! -
Add to your
.env.localfile:
# Add this line to .env.local
SUPABASE_SERVICE_ROLE_KEY=eyJhbGc...your-actual-service-role-key-here# Stop current server (Ctrl+C in terminal)
pnpm devGo to http://localhost:3000/report and try uploading an image.
If you still get errors, the bucket might not be configured correctly. Delete and recreate it:
- Supabase Dashboard → Storage → Buckets
- Click on
report-images→ Settings → Delete bucket
- Click "New bucket"
- Fill in:
Name: report-images Public bucket: ✅ YES (check this box!) - Click "Create bucket"
- Do NOT add any policies - the service role key bypasses all policies
pnpm dev- Upload completes
- You get a response like:
{ "success": true, "data": { "url": "https://...supabase.co/storage/v1/object/public/report-images/..." } }
Check terminal output for errors:
Error: "SUPABASE_SERVICE_ROLE_KEY not found"
- You forgot Step 1. Add the service role key to
.env.local
Error: "Bucket not found"
- Bucket name is wrong or doesn't exist
- Make sure it's exactly
report-images(no spaces, no typos)
Error: "new row violates row-level security policy"
- Service role key is wrong or not configured
- Double-check you copied the
service_rolekey, not theanonkey
- Service role key added to
.env.local - Bucket named exactly
report-images - Bucket is marked as Public
- Dev server restarted
- No storage policies created (service role bypasses them)
The backend uses SUPABASE_SERVICE_ROLE_KEY which has full admin access to Supabase, including storage. This bypasses all Row Level Security policies.
Security:
- ✅ Service role key is server-side only - never exposed to client
- ✅ Only your backend can upload files
- ✅ Public bucket allows viewing images (needed for displaying reports)
- ✅ No anonymous uploads possible