Server: WithSupabaseConfig

Configuration for withSupabase and createSupabaseContext.

Controls which auth modes are accepted, environment overrides, and CORS behavior.

Parameters

• auth

  (Optional)

  Auth mode(s) to accept. Modes are tried in order — the first match wins. A mode falls through only when its credential is absent; a present-but-invalid JWT short-circuits the chain with `InvalidCredentialsError`.

• allow

  (Optional)

• env

  (Optional)

  Override auto-detected environment variables. Useful for testing or when running in environments without standard env var support.

• cors

  (Optional)

  CORS configuration for the `withSupabase` wrapper. - `'default'` — uses `@supabase/supabase-js` default CORS headers. - `'disabled'` — disables CORS handling entirely. - `{ headers }` — custom CORS headers. The boolean (`true`/`false`) and bare `Record` forms are deprecated but still accepted for backward compatibility.

• supabaseOptions

  (Optional)

  Options forwarded to both internal `createClient()` calls. `accessToken` is stripped, and auth settings (`persistSession`, `autoRefreshToken`, `detectSessionInUrl`) are force-overwritten to server-safe values.

Examples

Basic usage

// Require authenticated users, auto-CORS enabled (default)
const config: WithSupabaseConfig = { auth: 'user' }

// Accept users or service-to-service calls, custom CORS headers
const config: WithSupabaseConfig = {
  auth: ['user', 'secret'],
  cors: { 'Access-Control-Allow-Origin': 'https://myapp.com' },
}

// No auth required, CORS disabled
const config: WithSupabaseConfig = { auth: 'none', cors: 'disabled' }