Skip to content
REST API

Build an API route in less than 2 minutes.

Create your first API route by creating a public leaderboard table.

This guide covers creating a REST route you can query using cURL or the browser by creating a database table called leaderboard to hold player scores. This creates a corresponding API route /rest/v1/leaderboard which can accept GET, POST, PATCH, and DELETE requests.

1
Set up a Supabase project with a 'leaderboard' table

Create a new project in the Supabase Dashboard.

After your project is ready, create a table in your Supabase database. You can do this with either the Table Editor or the SQL Editor.

-- Create a "leaderboard" table to store
-- player names and their scores.
create table leaderboard (
  id serial primary key,
  player text not null,
  score integer not null default 0,
  created_at timestamptz default now()
);
2
Enable Data API access to Anon Role

Expose the leaderboard table through the Data API so it can be queried over HTTP. A leaderboard is meant to be public, so anonymous clients only need read access.

For more control over which tables and functions are exposed, read the Grant access explicitly guide.

-- Allow read-only access for anonymous clients
grant select on public.leaderboard to anon;
3
Configure RLS

Enable Row Level Security (RLS) for this table and create the policies that control who can read and write rows. For a leaderboard, anyone should be able to read scores. Only authenticated users should be able to submit or update them.

-- Turn on RLS
alter table "leaderboard"
enable row level security;
-- Anyone can read the leaderboard
create policy "Leaderboard is public"
  on leaderboard
  for select
  to anon, authenticated
  using (true);
-- Authenticated users can submit and update scores
create policy "Authenticated users can submit scores"
  on leaderboard
  for insert
  to authenticated
  with check (true);
create policy "Authenticated users can update scores"
  on leaderboard
  for update
  to authenticated
  using (true)
  with check (true);
4
Enable Data API access for authenticated and service roles

With RLS setup, grant write access to the authenticated and service_role roles.

-- Grant write access only after RLS and policies are in place
grant select, insert, update, delete on public.leaderboard to authenticated;
grant select, insert, update, delete on public.leaderboard to service_role;
5
Insert some dummy data

Now add some scores to the table so the API has something to query.

insert into leaderboard (player, score)
values
  ('alice', 4200),
  ('bob', 3700),
  ('carol', 5100),
  ('dave', 2900);
6
Fetch the data

You can find your API URL and Keys in the Settings > API Settings section of the Dashboard. Query the leaderboard table by appending /rest/v1/leaderboard to the API URL.

Copy this block of code, substitute <PROJECT_REF> and <PUBLISHABLE_KEY>, then run it from a terminal.

curl 'https://<PROJECT_REF>.supabase.co/rest/v1/leaderboard?select=*&order=score.desc' \
-H "apikey: <PUBLISHABLE_KEY>"

Bonus#

There are several options for accessing your data:

Browser#

You can query the route in your browser, by appending the publishable key as a query parameter:

https://<PROJECT_REF>.supabase.co/rest/v1/leaderboard?apikey=<PUBLISHABLE_KEY>

Curl#

curl 'https://<PROJECT_REF>.supabase.co/rest/v1/leaderboard?select=*&order=score.desc' \
  -H "apikey: <PUBLISHABLE_KEY>" \

Client libraries#

We provide a number of Client Libraries.

const { data, error } = await supabase
  .from('leaderboard')
  .select()
  .order('score', { ascending: false })