Site Haus Back to Site Haus

Supabase

Give a web app a database, sign-in and file storage from your own Supabase project. The app gets its address and public key as secrets, and the AI knows to use them.

Supabase is a hosted database with sign-in and file storage. Connect your Supabase account once, then link one of your Supabase projects to any web app you build in Site Haus.

Connect Supabase#

Open Integrations → Supabase and choose one of:

  • Sign in with Supabase, if the site owner has set it up. You approve access on Supabase's own page.
  • An access token. In Supabase open Account → Access Tokens, make a token, and paste it. It is checked right away, stored encrypted and never shown again.
  1. Open a web app project and add the Supabase tool tab.
  2. Choose one of your Supabase projects and press Use this project.
  3. Restart the app if it is running, so it picks up the new values.

The app now has two secrets, SUPABASE_URL and SUPABASE_ANON_KEY. You can see their names in the Secrets tab but never their values. When you ask the AI to build something, it is told the app is linked and uses the supabase-js client with those values for the database, sign-in and storage. It never writes the key into a file.

What is copied, and what is not#

Only the project's public key (the anon or publishable key) is copied. That key is meant to be in the browser, and Row Level Security in your database decides what it can do. The powerful service-role (secret) key is never fetched, stored or shown. If a project's public key cannot be found, linking stops and says so.

Tables and security#

The AI is told to turn on Row Level Security for every table and add policies. When it needs tables, it writes the SQL as a file in the project (for example supabase/migrations/001_init.sql) and tells you to run it in the Supabase SQL editor. Site Haus does not change your database for you.

Switch or remove#

Choose a different project and press Switch, or Remove from this app to delete the two secrets. Your Supabase project is never touched. Disconnect in Integrations forgets your sign-in or token. Apps keep the keys they already have.