Use supabase/server to add auth and clients for Edge Functions

Install

npx skills add supabase/server

Who it's for

This skill fits people writing Edge Functions or APIs who do not want to keep handwriting auth, client creation, and CORS handling. Officially it is a server-side wrapper: auth, client creation, and context injection are handled, and you write business logic. It also fits people already using an AI coding agent — the source says you can install the skill into agents such as Claude Code and Cursor.

It does not fit people who only build browser pages and never touch a server entry. The request must enter Edge Functions or an API before client creation and auth are automatically scoped to the inbound request. If you do not yet have an agent that can install skills, confirm you can run the official install command before continuing. A read-only check is also fine: ask the agent to explain how to wrap fetch with one line of config, and do not change production functions yet. The official repository is

https://github.com/supabase/server

Follow the commands already written on that page.

First try in 3 minutes

Take only the one skill-install path the official text writes.

Prerequisite: this machine can run npx, and you use one of the AI coding agents named in the source, for example Claude Code or Cursor. Opening the project where you normally write Edge Functions or APIs is enough. This step is an explanation check; do not change live code and do not send outbound requests.

Install location: in a terminal at the project root, run:

npx skills add supabase/server

That command installs the skill into the current agent. The official text also says: in Deno or Supabase Edge Functions you can skip a package install and import directly from npm:@supabase/server.

Trigger a low-risk task: ask the agent that has the skill to list in text “how to wrap fetch with withSupabase so the handler runs only after auth succeeds”, and to write the import statement. Do not write files, call external APIs, or deploy.

Success signal: the agent can restate that after one import and one line of config, auth is checked, the client is ready, CORS is handled, and the handler runs only after auth succeeds; and it gives import { withSupabase } from "npm:@supabase/server". If it invents another install command, go back to the official command above and retry.

Use cases

Case 1: Add the official wrapper to the fetch entry of an existing Edge Function or API. The main path in the source is wrapping fetch with withSupabase: after one import and one line of config, auth is checked, the client is ready, CORS is handled, and the handler runs only when auth succeeds. You can first ask the agent to mark the entry that should change and the business code that should stay as-is, then act after confirmation. When the source has no complete function sample, stop at “the entry is wrapped, and failed auth does not enter the handler”; do not invent a routing table or a secrets scheme.

Case 2: Import directly in Deno or Supabase Edge Functions instead of installing a package first. The source says that environment can skip install and use import { withSupabase } from "npm:@supabase/server" directly. This fits people already writing handlers in that runtime who only want to check the import path. First confirm the import applies to the current file's runtime; if the project is not Deno or Edge Functions, the source stops here — do not extend it to an unnamed runtime.

Boundaries

The source only covers the server entry: client creation and auth are automatically scoped to inbound requests that enter Edge Functions and APIs. It does not prove use on browser pages, background cron jobs, or unnamed hosting environments.

Only one skill install command is written in the source: npx skills add supabase/server. Do not put an installer that never appears onto the main path. The source names Claude Code, Cursor, and others as an example set, not as the only two supported agents.

On the package-use side, the source gives the direct import for Deno / Supabase Edge Functions and wrapping fetch with withSupabase. If you do not see environment-variable names, CORS detail switches, or a failure-retry policy, do not invent them. The handler runs only after auth succeeds; which status code is returned on failure is not written. The official page is