Closes DOCS-1176
## Summary
This PR adds documentation-writing guidance for humans and agents, then
applies it to the “Securing your API” guide.
## Changes
- Add a documentation word list based on Google’s style guide and
existing MDX lint rules.
- Add a shared `docs-guides` Agent Skill with Cursor and Claude
integration.
- Expand contributing guidance for information types, procedures,
chunking, links, admonitions, grammar, and terminology.
- Restructure “Securing your API” into contextual and procedural
sections.
- Add section navigation, cross-references, transitions, and procedural
outcomes.
- Reduce repeated admonitions and improve scannability.
## Manual testing
1. Open `/docs/guides/api/securing-your-api` in Preview and compare to
Live.
https://docs-git-docs-restructure-api-supabase.vercel.app/docs/guides/api/securing-your-api
2. See that the content is improved and clear with no important context
removed.
3. See the Admonitions that are no longer marked as admonitions. See the
content still makes sense.
4. Review the diff of `CONTRIBUTING.md` and `WORD_LIST.md`.
5. See that you agree with the new rules and that they are clear.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated documentation-writing guidelines with clearer standards for
structure, formatting, components, diagrams, terminology, and
navigation.
* Added a comprehensive word and style reference for consistent
documentation language.
* Reworked the API security guide with clearer guidance on grants, RLS,
dedicated schemas, pre-request checks, rate limiting, and API keys.
* Added documentation authoring workflow guidance, including validation
and formatting steps.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds a docs guide, "Choosing a server-side package", that explains when
to use `supabase-js`, `@supabase/ssr`, or `@supabase/server` when
working with Supabase from JavaScript on the server. It includes a
decision table and a short code example for each, with one rule up
front: cookie-based sessions in SSR frameworks use `@supabase/ssr`,
per-request header auth in Edge Functions and other backend runtimes
uses `@supabase/server`, and `supabase-js` is the base client both wrap.
The guide is surfaced from the Auth overview page and the sidebar, and
is cross-linked from the `supabase-js` and `@supabase/server` reference
introductions so it is reachable from where developers start. It also
states that the packages coexist and are not replacements for each
other, and keeps combining `@supabase/server` with `@supabase/ssr` as an
advanced section.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
- **New Features**
- Added a guide explaining how to choose between Supabase server-side
JavaScript packages.
- Added the guide to Auth navigation and the getting-started content
listings.
- Added links to the new guidance throughout relevant JavaScript and
server documentation.
- **Documentation**
- Clarified when to use cookie-based sessions versus header-based
authentication.
- Added package comparisons, usage examples, advanced guidance, and
related next steps.
- Updated spelling support for framework names used in the
documentation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Bug fix + partial revert.
## What is the current behavior?
1. `ContentListings.client.tsx` unconditionally derives `hasLightIcon`
from `Boolean(item.icon)`. `GlassPanel` appends `-light.svg` to the icon
path in light mode whenever `hasLightIcon` is true. Framework icons
(react, nuxt, hono, redwood, flutter, swift, kotlin, svelte, solidjs,
vue, refine, angular, ionic) have no `-light.svg` variants, causing
broken image requests in light mode for any ContentListings card that
uses them.
2. `getting-started.mdx` uses `<ContentListings
id="getting-started-overview" />` (added in #47097) for the top
three-card grid (Build with AI tools, API Keys, Local Development).
## What is the new behavior?
1. `hasLightIcon` is now an optional field in the item schema (defaults
to `Boolean(item.icon)` for backward compatibility). The component reads
`item.hasLightIcon ?? Boolean(item.icon)`, so data files can opt
specific icons out of the light-mode variant.
2. `<ContentListings id="getting-started-overview" />` is removed and
the original hand-authored GlassPanel grid is restored. The
`gettingStartedGetStarted` data entry and its registry import are also
removed.
ContentListings has no mandate to cover every section of every page: the
goal was for hub and overview pages to have a reasonable, standardized
link section that tooling can lint for. This page doesn't fit that
pattern.
## Additional context
| Check | Result |
|-------|--------|
| `pnpm vitest run lib/content-listings.test.ts` | ✅ 12/12 passed |
| `pnpm lint:mdx` (getting-started.mdx) | ✅ No warnings |
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the Getting Started guide with dedicated tiles for Build with
AI Tools, API Keys, and Local Development.
* Expanded the available Getting Started content listings.
* **Bug Fixes**
* Improved icon styling in content listings so light icon treatment
reflects each item’s configuration.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Nik Richers <nik@validmind.ai>
## Summary
- Adds the Vercel [`plugins`](https://www.npmjs.com/package/plugins) npm
package as the default, single-command install option (`npx plugins add
supabase-community/supabase-plugin`) on the Supabase AI coding agent
plugin docs page.
- Keeps the existing per-agent manual installation instructions
available below, as an alternative.
Closes AI-929.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added a quick-install option for the plugin using a single command.
* Documented the `--yes` flag for skipping the confirmation prompt.
* Updated the manual installation guidance to follow the new
quick-install instructions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- ccr-slack-attribution -->
_Requested by **Lakshan Perera** · [Slack
thread](https://supabase.slack.com/archives/C023E4L60R3/p1784055775538959?thread_ts=1784055775.538959&cid=C023E4L60R3)_
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update.
## What is the current behavior?
Both the "Edge Function bundle size issues" troubleshooting page and the
Edge Functions "Limits" page stated only a single **20 MB** limit. In
practice, that 20 MB figure applies only to **local bundling** with the
Supabase CLI. When a function is deployed via the **Management API or
Dashboard**, bundling runs server-side and is capped at **5 MB** due to
an infrastructure (Lambda) limit. Customers deploying that way were
surprised to hit an error like `Function source code exceeds the maximum
deployment size (5 MB). Reduce the size of your function and try again.`
even though the docs implied 20 MB was available.
## What is the new behavior?
Both pages now state the distinction explicitly:
- **Local bundling (Supabase CLI):** up to **20 MB**.
- **Server-side bundling (Management API or Dashboard):** up to **5
MB**.
The troubleshooting page also adds a "Deploying larger functions"
section pointing customers at the workaround: if a function is under 20
MB but over the 5 MB server-side limit, bundle it locally by running
`supabase functions deploy` with the `--use-docker` flag to force local
bundling and get the higher limit.
## Additional context
**How / files changed:**
-
`apps/docs/content/troubleshooting/edge-function-bundle-size-issues.mdx`
— rewrote the intro to describe both limits, added the "Deploying larger
functions" workaround section, and fixed the frontmatter `keywords`
(replaced `"10MB"` with `"5MB"` and `"20MB"`).
- `apps/docs/content/guides/functions/limits.mdx` — updated the "Maximum
Function Size" line to list both the 20 MB local and 5 MB server-side
limits.
Before, both pages said only 20 MB, so customers deploying via the
API/Dashboard were surprised by a 5 MB error; after, both pages state
the 5 MB server-side vs 20 MB local distinction and point to local
bundling as the workaround.
---
_Generated by [Claude
Code](https://claude.ai/code/session_019bBXmQTRBWJbo3UTpfjPLU)_
Co-authored-by: Claude <noreply@anthropic.com>
## Info architecture change around "Partners"
The www "integrations" now become more partner-driven.
`/partners/integrations` -> now Partner Catalog under
`/partners/catalog` (old links redirect to new paths)
Moved them close together in the nav dropdown and in the footer
<img width="494" height="336" alt="Screenshot 2026-07-09 at 11 06 41"
src="https://github.com/user-attachments/assets/a875fef0-0ab8-47ca-8756-d658b27c4892"
/>
<img width="1149" height="665" alt="Screenshot 2026-07-09 at 11 09 48"
src="https://github.com/user-attachments/assets/9631bb72-fe25-4fb4-b1af-9f14a37d02e7"
/>
## /partners
This page remains untouched in this PR, updates to layout, content and
intake form are delegated to #47874
## /partners/catalog
Listed in the
[catalog](https://zone-www-dot-com-git-feat-www-partners-pages-supabase.vercel.app/partners/catalog)
are now partners. Some partners match with a listing.
<img width="1207" height="866" alt="Screenshot 2026-07-09 at 11 14 17"
src="https://github.com/user-attachments/assets/b65216be-976f-4ef5-91f8-1ad49da87b45"
/>
## /partners/catalog/[partner]
Each partner can have one or more "listings" which are either
- simple guides
- foreign data wrappers
- dashboard integrations
Integrations available in the dashboard now all have a prominent
"Install integration" cta to open it in the dashboard [integrations
page](https://supabase.com/dashboard/project/_/integrations).
<img width="1269" height="776" alt="Screenshot 2026-07-09 at 11 16 51"
src="https://github.com/user-attachments/assets/3c7bb715-ffce-4d0a-905f-9a660c3b1f5a"
/>
## Docs
Update docs →
[Preview](https://docs-git-feat-www-partners-pages-supabase.vercel.app/docs/guides/integrations)
- remove "Supabase marketplace"
- use "Dashboard Integrations and Partner Catalog
- update integrations in sidenav to link to updated /partners/catalog/**
listings
<img width="1520" height="696" alt="Screenshot 2026-07-15 at 12 54 47"
src="https://github.com/user-attachments/assets/9f5a2794-4536-4299-97df-9732d3d75b4c"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a Partner Catalog experience with search, category filters,
official-partner toggle, responsive filtering (sidebar + bottom sheet),
grid/list views, and featured partners.
* Added Partner Catalog detail pages with tabbed listings, MDX-rendered
content, image gallery with zoom overlay, and “add/install” actions.
* **Improvements**
* Updated “Become a Partner” layout and form support for prefilled
values and checkbox-group fields (including validation).
* Updated navigation/footer/docs and partner tile links to use Partner
Catalog routes; expanded redirects from legacy integrations paths.
* Added public agent-skills discovery manifest.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Alan Daniel <stylesshjs@gmail.com>
Co-authored-by: Alex Hall <alex.hall@supabase.io>
Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>
The comparison operator `<<` check if lhs is strictly contained by the
rhs. Meaning a `/32` would return false for `/32` as the lhs is not
contained, but equal to the rhs. The `<<=` is operator checks if a
subnet is strictly contained or equal to which fixes the `/32` case.
[1] https://www.postgresql.org/docs/17/functions-net.html#FUNCTIONS-NET
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the `before-user-created` hook SQL example to use the correct
IP/CIDR containment syntax for both allow and deny network checks.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Chris Stockton <chris.stockton@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
This PR converts link sections in the self-hosting overview page to the
`ContentListings` component, puts conceptual guidance before deployment
options, and adds badge support for the Docker card (minor).
Relates to DOCS-1137
## Current behavior
`self-hosting.mdx` uses hand-authored `<GlassPanel>` / `<Link>` JSX for
two sections:
- **Get started**: Docker card with a JSX title containing a `<Badge>`
element (was previously deferred for this reason).
- **Community-driven projects**: Two cards with trivial `<span>`-wrapped
string titles.
Get started and Community cards appear at the top of the page, before
the conceptual overview. The Support and community section uses
hand-authored bullet lists for GitHub, Discord, and Reddit links.
## New behavior
- The self-hosting overview page now uses data-driven `ContentListings`
instead of hand-written cards and bullet lists.
- Conceptual content (how self-hosting differs, your responsibilities,
telemetry) comes first; deployment options and community resources
follow.
- Section intro text lives in listing data rather than inline MDX.
- Brand icons added to all listing cards (Docker, Kubernetes, Traefik,
GitHub, Discord, Reddit).
- Minor: Added support for badges to content listings, such as
"Official" in the Docker tile
Data lives in `self-hosting.data.ts` (5 groups, 8 links) and is
registered in `content-listings/index.ts`.
## Additional context
### Icon usage rights
New brand icons (Kubernetes, Traefik, Reddit) are sourced from [Simple
Icons](https://simpleicons.org) (CC0 1.0). Existing icons (Docker,
GitHub, Discord) reuse assets already in `apps/docs/public/img/icons/`.
Use is non-commercial documentation only — consistent with existing docs
icon usage and trademark fair-use for identifying linked third-party
services.
### To do:
- [ ] Check with @aantti if he's on board with switching the page to
content listings we can lint for and the content restructure to match
other overview pages
## Verification
| Gate | Result |
|------|--------|
| `pnpm vitest run lib/content-listings.test.ts` | ✅ 12/12 passed |
| `pnpm build:guides-markdown` | ✅ 744 files generated |
| `pnpm lint:mdx` (self-hosting.mdx) | ✅ No warnings on changed file |
### Proof: restructured self-hosting page with ContentListings and icons
| [Before (production)](https://supabase.com/docs/guides/self-hosting) |
[After (PR
preview)](https://docs-git-nikrichers-docs-1137-self-hosting-supabase.vercel.app/docs/guides/self-hosting)
|
|---|---|
|
|
|
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Updated the self-hosting guide to use dynamic content listings for
“Get started,” community resources, support options, and sharing
experiences.
* Added richer listing cards with optional badges and improved icon
handling.
* Expanded self-hosting resource groups to surface more relevant links
in docs navigation.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Nik Richers <nik@validmind.ai>
## Summary
Fixes the Remix and React Router sections of the SSR "creating a client"
guide, which showed three separate `_index.tsx` snippets (Loader,
Action, Component) with two different `loader` exports that cannot
coexist in one route, leaving readers unsure which to use.
Each framework now has a short intro plus a single coherent
`_index.tsx`: one `loader` that creates the server client and returns
the env vars, one `action`, and a browser-client component that reads
those env vars via `useLoaderData`. Along the way this also fixes three
React Router bugs: the invalid `'@react-router'` import, the dropped
cookie `options` argument in `setAll`, and the incomplete `return ...`
in the component.
One thing worth a reviewer check: a loader that both sets cookies and
returns data must return through the `json` (Remix) / `data` (React
Router v7) helper with `{ headers }` rather than a plain object, so the
`Set-Cookie` headers are preserved.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **Documentation**
* Updated the server-side “creating a client” guide for Remix and React
Router SSR examples.
* Refreshed the example structure to a single end-to-end route setup
with `loader`, `action`, and one default page component.
* Improved SSR cookie and header handling to better match practical
server/client behavior.
* Passes the required Supabase URL and publishable key from the server
to the browser so the client can be initialized with `useLoaderData`.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Miranda Limonczenko <miranda.limonczenko@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update
## What is the current behavior?
We do not discuss the current settings in the configuration docs:
- max_logical_replication_workers
- max_sync_workers_per_subscription
## What is the new behavior?
Shows users they can update the following pg_settings with the CLI:
- max_logical_replication_workers
- max_sync_workers_per_subscription
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the custom PostgreSQL configuration guide with additional
CLI-supported parameters.
* Added documentation for logical replication and subscription
synchronization worker settings.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Two related docs changes for debugging Supabase, consolidated into one
PR.
## 1. New "Debugging" guide (`guides/telemetry/debugging`)
A methodology and entry page for debugging any Supabase issue, added
next to Logging in the Telemetry nav. It covers:
- **The debugging loop** — read the exact error, isolate the failing
layer, gather evidence, fix, verify.
- **The Supabase request stack** — the gateway fans out to PostgREST,
GoTrue, Storage, and Realtime as parallel services (not a chain), with
Postgres underneath. Explains why an API-layer permission or
empty-result error is usually a Postgres RLS/privilege issue.
- **Reading logs** — the narrow-query discipline (one source, bounded
window, widen along an anchor), linking the Logs Explorer guide rather
than duplicating query syntax.
- **Symptom to guide routing table** — maps each symptom to its layer
and the specific troubleshooting guide, acting as a front door to the
troubleshooting collection. All 47 links verified live.
This puts the debugging methodology in docs (owned and updatable)
instead of only in the agent skill.
## 2. Log-query best practices (`guides/telemetry/logs`)
Adds the three practices the existing Best practices list was missing,
all engine-agnostic: query one source at a time, follow a request across
sources with an anchor, and reference only confirmed field names.
## Follow-up (not in this PR)
The Logs Explorer now defaults to **ClickHouse** (single `logs` table,
`log_attributes` map), but `guides/telemetry/logs.mdx` and the two logs
troubleshooting guides still document the legacy **BigQuery** dialect
(`cross join unnest(metadata)`). They need a coordinated BigQuery to
ClickHouse migration pass:
- `guides/telemetry/logs.mdx`
-
`troubleshooting/how-to-interpret-and-explore-the-postgres-logs-OuCIOj.mdx`
-
`troubleshooting/discovering-and-interpreting-api-errors-in-the-logs-7xREI9.mdx`
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new “Debugging” guide with a step-by-step workflow for
identifying where issues originate versus where they appear.
* Added a symptom-to-layer troubleshooting mapping and linked it from
Telemetry navigation.
* **Documentation**
* Updated Logs Explorer guidance to note its ClickHouse default and that
examples use legacy BigQuery syntax.
* Expanded Logs Explorer best practices, including querying one source
at a time, correlating with anchors, and using only confirmed field
names.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- docs update
Scheduled follow-up to #47252 / DOCS-1080.
## What is the current behavior?
- Docs include a temporary note admonition on five pages: "This default
takes effect for new projects from July 9, 2026." (#47252)
- The `do-not-merge` label blocks CI until this PR is ready to merge.
## What is the new behavior?
- Removes the temporary effective-date admonition partial and all
`$Partial` includes.
- Default-behavior copy from #47199 remains unchanged.
## Additional context
**Do not merge before July 9, 2026.**
### Merge instructions (July 9)
1. Rebase this branch onto `master` after #47252 has merged (should
remain a clean removal-only diff)
2. Remove the `do-not-merge` label
3. Confirm CI is green and merge
Review screenshots live in `.github/pr-screenshots/docs-1080/` on this
branch for PR proof only.
### Test plan
- [ ] After rebase, confirm the five pages no longer show the
effective-date admonition
- [ ] Confirm default-behavior copy from #47199 remains unchanged
- [ ] Remove `do-not-merge` label and merge on July 9, 2026
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Cleaned up several security, compliance, telemetry, and PostgreSQL
logging docs by removing a repeated note about when default connection
logging behavior takes effect.
* Streamlined the affected pages so the guidance now flows more directly
without the extra embedded note.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: Nik Richers <nik@validmind.ai>
FUP to https://github.com/supabase/supabase/pull/47709
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the Next.js Sentry setup guide with clearer wording and a
step-by-step configuration flow.
* Added explicit instructions for instrumenting Supabase clients in
server, browser, and middleware contexts.
* Included guidance for enabling query and mutation data capture so
Supabase activity appears in monitoring as database spans.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update.
## What is the current behavior?
The Sentry monitoring guide documents the third-party
`@supabase/sentry-js-integration` package. Sentry now ships Supabase
support natively in the JavaScript SDK (v9.14.0+), and the documented
API is incompatible with current `@sentry/*`, so the snippets no longer
work as written.
Fixes#47708.
## What is the new behavior?
All snippets are updated to the built-in API
(`Sentry.supabaseIntegration({ supabaseClient })` and
`Sentry.instrumentSupabaseClient(client)`). The Next.js section is
simplified to a single instrumentation call that covers browser, server,
and edge. The span deduplication example is corrected (supabase-js uses
`fetch`, so it filters `nativeNodeFetchIntegration`). Added a note about
the v9.14.0 requirement with the community package as the fallback for
v7, and removed the now-unnecessary install section.
## Additional context
Verified end-to-end against `@sentry/node` + `@supabase/supabase-js`:
both entry points produce `db` spans for select/insert/update/delete and
capture PostgREST errors.
**Note**: This PR was created entirely through Claude Code Opus 4.8,
with code snippets tested in a sample project.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the telemetry guide to use Sentry’s built-in Supabase support
(`@sentry/*`) instead of a community integration.
* Added explicit setup requirements for Sentry JS SDK version 9.14.0+.
* Provided two enablement options, including instrumentation when
Supabase client setup and Sentry initialization are separate.
* Refreshed guidance for span deduplication and improved Next.js setup
instructions, including operation payload capture.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Co-authored-by: Kamil Ogórek <kamil.ogorek@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Summary
Adds two new optional onboarding steps — **Install Agent Skills** and
**Install MCP server** — to every framework quickstart guide, right
after the "create app" step, so readers are pointed at [Agent
Skills](/docs/guides/ai-tools/ai-skills) and the [Supabase MCP
server](/docs/guides/ai-tools/mcp) early in the setup flow.
**Where each step lives:**
- **16 quickstarts that include the shared `quickstart_db_setup.mdx`
partial** (Next.js, Astro, Expo/React Native, Flask, Flutter, Hono,
iOS/SwiftUI, Kotlin, Laravel, Nuxt, React, Refine, SolidJS, SvelteKit,
TanStack Start, Vue): the partial itself now has a step 2 "Install MCP
server (optional)" (between project creation and database setup), and
each individual file gets its own "Install Agent Skills (optional)" step
right after its app-creation step.
- **RedwoodJS and Ruby on Rails** (don't use the shared partial): got
both steps added inline, in the same order (Agent Skills, then MCP
server), since they can't inherit from the partial.
- All subsequent step numbers (and the "Step N" cross-references in
prose, e.g. in RedwoodJS) were renumbered to stay sequential.
## Test plan
- Check the quickstarts locally or in preview.
- Any other ideas on how to optimise showing these items?
- Does the SQL prefill add anything?
- Other ideas on how to simplify without losing the information?
- Check the MD output too and see if that also makes sense.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Refreshed multiple getting-started quickstarts with consistent,
clearer step sequencing (including renumbering) across frameworks.
* Added an optional “Install Agent Skills” step where applicable, plus
updated placements of shared environment-variable setup content.
* Simplified the database quickstart flow: single “Create a Supabase
project” step, streamlined SQL Editor instructions for creating an
`instruments` table, enabling RLS, and granting public read access.
* Added optional “Install MCP server” steps in the relevant quickstarts.
* **Style**
* Updated MDX linting rules to allow the uppercase phrase “Agent
Skills”.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
Co-authored-by: Nik Richers <nrichers@gmail.com>
## What kind of change does this PR introduce?
Documentation improvement
## What is the current behavior?
The documentation for using custom schemas is buried under the REST API
section (`/guides/api/using-custom-schemas`), making it hard for users
to find when they first encounter schemas in the database documentation.
Users who create custom schemas often don't realize they need to
configure API access and grant permissions, leading to confusion.
Closes#39856
## What is the new behavior?
Three improvements to make custom schemas documentation more
discoverable:
1. **Cross-reference in tables page**: Added an admonition tip after the
"Schemas" section in `/guides/database/tables` linking to both the
"Using Custom Schemas" guide and the "Hardening the Data API" guide
2. **Navigation sidebar**: Added "Using Custom Schemas" link under
"Database > Access and security" in the sidebar navigation, so users can
find it from the database section without having to navigate to the API
section
3. **service_role mention**: Updated the schema grants example in
"Hardening the Data API" to include `service_role` alongside `anon` and
`authenticated`, since users with server-side access also need this
grant
## Additional context
The issue author spent hours debugging custom schema access because the
documentation wasn't linked from where schemas are first introduced (the
database tables page). These changes create a clear path from learning
about schemas → configuring API access → security hardening.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Added "Using Custom Schemas" guide to the navigation menu under
Database -> Access and security section
* Enhanced Data API hardening documentation with clarification on
service_role permissions for server-side database access
* Added instructional tips regarding custom schema exposure via Data API
and proper permission configuration
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Hello team and community! Decided that I want to start helping to
maintain supabase, and decided to open my first PR with clearing typos
and phrasing improvements for docs in AI folder.
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Refined and corrected grammar throughout AI implementation guides,
improving readability across production deployment, Google Colab
integration, LangChain, RAG with permissions, semantic search, and
vector columns documentation. Updates include terminology consistency
improvements, punctuation refinements, and clearer phrasing to enhance
overall guide clarity.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris@chrischinchilla.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
Docs update.
*
https://docs-git-docs-wire-server-v1-reference-supabase.vercel.app/docs/reference/server/introduction
*
<img width="417" height="628" alt="Screenshot 2026-07-06 at 6 13 33 PM"
src="https://github.com/user-attachments/assets/9fc27b04-038b-4434-8855-94051f898b5d"
/>
## What is the current behavior?
`@supabase/server` has no reference documentation page in the Supabase
docs. The library publishes a TypeDoc spec to GitHub Pages but the docs
pipeline was not wired up to consume it.
## What is the new behavior?
- Adds `spec/reference/server/v1/` with a `config.json` (category order:
Middleware, Primitives, Adapters, Errors, Types) and `partials/` for the
introduction and installing pages.
- Adds a `download.server.v1` Makefile target that fetches
`https://supabase.github.io/server/spec.json` into
`spec/reference/server/v1/server.json`, and wires it into the top-level
`download` target so it runs with the rest.
- Registers `server-v1` in `SUPPORTS_NEW_REFERENCE_PROCESS` so the build
pipeline picks up the new spec directory and generates
`content/reference/server/v1/` at build time.
- Seeds the generated `docs/ref/server/` partials (introduction and
installing) that the reference router serves.
## Additional context
The TypeDoc spec is produced by `@supabase/server`'s `docs.yml` workflow
on every push to `main`, so `make download.server.v1` will always pull
the latest published API surface. The companion PR in the server repo
([supabase/server#95](https://github.com/supabase/server/pull/95)) adds
the `@category` tags that the pipeline requires for symbols to appear in
navigation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a new **Server SDK** item under **Reference**, linking to
`/reference/server` and marked with a **New** badge.
* Published **Server Reference v1** documentation for
`@supabase/server`, including **Introduction** and **Installing** pages.
* **Chores / Improvements**
* Enhanced the reference documentation generation to include Server v1
content.
* Improved reference detail handling (including clearer TypeDoc output
such as **Deprecated** notes).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
- Cleaning of partial affecting all frameworks first steps for database
setup.
- Removed unnecessary and somehow broken accordion.
- Improved copy.
- Removed unnecessary button.
As a result instruction for both LLMs and humans are inline, though
encoded link is not produce, the instructions are below for agents to
pick.
<img width="889" height="797" alt="Screenshot 2026-07-06 at 17 27 22"
src="https://github.com/user-attachments/assets/91a4fda0-5be9-4452-bcf9-93540f4c88f7"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Simplified the “Set up your database” quickstart into a clearer,
single-step flow.
* Embedded the complete setup SQL directly in the guide for easy
copy/paste.
* Replaced the prior prefill button and accordion/manual steps with a
tip containing a prefilled-SQL link, plus optional guidance to run the
SQL as needed.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
https://github.com/user-attachments/assets/fba86c42-a122-4eb5-8531-db663d022100
Makes a few style and content changes focused on our quickstarts,
starting with
- docs/guides/getting-started/quickstarts/reactjs
- docs/guides/getting-started/quickstarts/nextjs.
Changes
- Reduced container size and increased x padding for more breathing room
- Adjusted header padding and spacing
- Stripped non critical content from guides
- Merged steps where possible e.g. one sql blocks to run instead of
multiple
- Moved shadcn/supabase ui components into a next step
- Introduced a step for installing agent skills (in future can be
plugin)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated multiple quickstarts to add an **“Open Connect panel”**
primary action for environment-variable setup.
* Removed extra UI CTA partials from several “Query” sections.
* Added **Next steps** links to drop-in UI components and extended the
database flow with an optional **agent skills** step.
* **UI / Guide Layout**
* Refreshed guide spacing/typography (breadcrumb spacing, header
margins, and removed subtitle divider).
* Adjusted guide/table-of-contents sizing and tightened step/details and
code section alignment.
* Updated main layout width and padding for docs pages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added new public MCP base URL environment variables for hosted and
self-hosted setups.
* Introduced reusable MDX components to render custom MCP configuration
content.
* **Documentation**
* Updated the MCP guide to reference shared MCP server template values
for examples.
* Swapped the CI configuration example for a component-rendered snippet
for consistency.
* **Bug Fixes**
* Improved self-hosted MCP base URL fallback so it prefers the new
non-platform URL when no custom API URL is provided.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
## Description
Fix typo in URL: `RLS-Perfomance` → `RLS-Performance` in troubleshooting
documentation.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Corrected a broken link in the troubleshooting documentation so the
“Sample results” section now points to the proper page.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Closes DOCS-1087
<img width="1493" height="688" alt="Screenshot 2026-06-30 at 4 50 52 PM"
src="https://github.com/user-attachments/assets/39267c8a-befb-4419-8fa8-4e987f82781e"
/>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## Problem
The Network Restrictions docs contain an incorrect curl example that,
when followed, restricts the entire database instead of adding only the
specified IP/CIDR — causing production outages for users.
## Solution
Fix the incorrect curl command in the Network Restrictions docs so that
it correctly adds only the specified CIDR rather than restricting the
entire database.
This PR solves the problem by adding an `--append` CLI procedure.
Additionally, the document is improved:
- All procedures are put in procedure format for easier readability and
clear action steps
- Wording is simpler
- Headers follow convention
- A "This topic..." intro paragraph is added
## Tophatting
1. Go to the preview link at
`/docs/guides/platform/network-restrictions`.
2. Verify that the new `--append` section corrects the original issue.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Reworked the network restrictions guide into clearer “dashboard” and
“CLI” setup flows.
* Expanded the intro with IPv4/IPv6 CIDR allowlisting guidance,
including exceptions for IPv6 migration extensions and when the IPv4
add-on is installed.
* Updated the CLI instructions with structured examples for checking,
replacing, appending, and fully removing restrictions (including the
“never applied” case when allowed lists are empty).
* Clarified scope/limitations: restrictions apply to Postgres and its
pooler (not HTTPS APIs or client libraries), and enabling restrictions
blocks Edge Function direct database access.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Andrew Valleteau <avallete@users.noreply.github.com>
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
- closes https://github.com/supabase/supabase/issues/47555
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the password verification guide to use the `current_password`
parameter name consistently.
* Aligned the example code with the current parameter format for user
password updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES
## What kind of change does this PR introduce?
update pg changes documentation
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Documentation**
* Updated the Realtime Postgres Changes guide with a new, generalized
“Listening to specific events” section (including INSERT/UPDATE/DELETE/*
examples) and standardized `event` usage.
* Refreshed “Available filters” with a unified filter builder approach,
expanded operator reference, consistent Filter-string/tab patterns,
`not.` and `AND` guidance, and clearer limitations (including
delete-event filtering).
* Updated “Selecting specific columns” examples to match the latest
payload/subscription guidance.
* **Refactor**
* Simplified the Realtime limits estimator by removing filter-based
throughput inputs and related UI/table columns; throughput is now based
on compute add-on, RLS, and concurrency.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
This PR syncs the latest troubleshooting guides from the
supabase/troubleshooting repository.
---------
Co-authored-by: github-docs-bot <github-docs-bot@supabase.com>
Co-authored-by: Chris Chinchilla <chris.ward@supabase.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Creating publishable and secret keys adds them alongside the existing
anon and service_role keys without affecting them. Make this explicit in
two places so users don't assume their legacy keys are revoked:
- Add an Admonition note to the API keys guide explaining both key types
work simultaneously and legacy keys must be disabled in a separate step.
- Update the "Create new API keys" dialog in Studio to reassure users
that their existing anon and service_role keys remain valid.
## Problem
Now that `docs` is the only place where we use the deprecated `ui/Tabs`,
we can move this component and the related HOC from `ui-patterns` in
`docs`
## Solution
- Move `ui/Tabs`, `ui-patterns/ComplexTabs/withQueryParams` and
`ui-patterns/ComplexTabs/withSticky` to `docs`
- Refactor `ui-patterns/ComplexTabs/withQueryParams` and
`ui-patterns/ComplexTabs/withSticky` HOCs as hooks to make them easier
to understand
- Refactor `Tabs` accordingly
No visual nor functional changes.
## How to test
On
https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/auth/passwords
(Tabs are driven by URL and the flow tabs should have sticky headers
even though there's a CSS bug already reported)
- check that by default, the first tab in each tabs is active
- change the tabs in different groups and validate it works
- refresh the page and check that previously selected tabs are active
(URL based selection)
- In a new tab, visit
https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/auth/passwords
again and check that previously selected tabs are active (LocalStorage
based selection)
Do the same on
https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/database/database-advisors
(This one is driven by URL but does not have sticky tab headers)
Do the same on
https://docs-git-chore-refactor-docs-tabs-supabase.vercel.app/docs/guides/deployment/terraform/reference
(this one is not driven by URL nor has sticky tab headers)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Docs tabs now persist and restore the active tab via URL query
parameters.
* Added optional “sticky” tab behavior that keeps the active panel in
view.
* Enhanced keyboard interaction for selecting tabs.
* **Bug Fixes**
* Improved active-tab initialization and synchronization when the URL
query changes.
* **Chores**
* Refreshed the tabs UI implementation and styling to improve
consistency and remove deprecated tab exports from shared UI packages.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What
Routes the **Dart/Flutter v2** reference through the new
reference-content pipeline (`scripts/build-reference-content.ts` +
`spec/reference/dart/v2/`), the same one JavaScript v2 already uses.
Dart v1 stays on the legacy YAML pipeline.
## How
Dart has no upstream TypeDoc dump, so this follows the reference
README's "adapt other formats as a pre-step" approach:
- **`scripts/generate-dart-reference.ts`** converts the committed legacy
spec (`spec/supabase_dart_v2.yml`) plus the shared section tree into a
TypeDoc-shaped dump at `spec/reference/dart/v2/supabase_flutter.json`
(gitignored, like every other dump). Each Dart method becomes a
`variant: 'declaration'` node tagged with `@category`/`@subcategory` and
carries the legacy function shape (description, notes, params, examples)
on a non-TypeDoc `content` field.
- **`build-reference-content.ts`** gains a small, backward-compatible
addition: it spreads a declaration's `content` straight onto the
`functions.json` entry. The renderer then shows params/examples/notes
exactly as the legacy YAML did, with no typeSpec round-trip. The field
is absent for real TypeDoc dumps, so **JavaScript output is unchanged**
(existing JS snapshot still passes).
- `dart-v2` added to `SUPPORTS_NEW_REFERENCE_PROCESS`; the v2 `specFile`
is dropped from the nav entry so the legacy generator skips it.
- Dart search ingest switched to the new-pipeline loader.
- `config.json` + hand-authored partials (intro markdown,
`initializing`, and subcategory overviews like `using-filters`,
`auth-mfa`) added under `spec/reference/dart/v2/partials/`, mirroring
the JS lib.
- The dart dump is regenerated in `codegen:references:new` and in CI; a
self-contained `dart/v2` snapshot test covers the full YAML → dump →
content path.
## Verification
- `vitest run scripts/build-reference-content.test.ts` — both JS and
Dart snapshots pass.
- 112 function sections all resolve to renderable `functions.json`
entries (104 methods + 7 subcategory overviews + `initializing`).
- `tsc --noEmit` clean for all changed files.
- Legacy generator confirmed to skip dart v2 (only `dart.v1.*`
regenerated).
> Note: the live dev server (which needs the Supabase backend) was not
run; verification was done at the data-pipeline level plus parity with
the production JS pipeline behavior.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Dart v2 reference documentation sections, including Installing,
Initializing, Filters, Modifiers, Auth Admin, MFA, Passkeys, File
Buckets, Introduction, and Upgrade guidance.
* Expanded the Dart v2 reference pipeline so Dart API pages are
generated from the newer reference content flow.
* **Bug Fixes**
* Improved Dart reference rendering by preserving legacy descriptions,
notes, params, and examples in generated function entries.
* Updated Dart v2 reference search to use the new pipeline’s generated
content so results and navigation stay in sync.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Jeremias Menichelli <jmenichelli@gmail.com>
## I have read the
[CONTRIBUTING.md](https://github.com/supabase/supabase/blob/master/CONTRIBUTING.md)
file.
YES/NO
## What kind of change does this PR introduce?
Bug fix, feature, docs update, ...
## What is the current behavior?
Please link any relevant issues here.
## What is the new behavior?
Feel free to include screenshots if it includes visual changes.
## Additional context
Add any other context or screenshots.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Refreshed theming across the UI to use modern color expressions and
shared theme variables (including OKLCH-based gradients), improving
consistency for charts, code blocks, overlays, icons, and decorative
backgrounds.
* **Bug Fixes**
* Improved light/dark color and gradient consistency across axis/grid
styling, reference lines, buttons/badges, sidebar accents, loaders, and
other visual components.
* **Documentation**
* Updated styling/theming guidance to align with the revised semantic
token system and the updated theme variable usage patterns.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Miranda Limonczenko
