Supabase service role key in the browser? Lock it back

// lib/supabase/admin.ts: the master key, server only
import 'server-only';
import { createClient } from '@supabase/supabase-js';

export const supabaseAdmin = createClient(
  process.env.SUPABASE_URL!,
  process.env.SUPABASE_SECRET_KEY!
);

Supabase’s backend client, plus import 'server-only': if a client component ever imports this file, the build fails with a clear error instead of shipping the key.

-- Who is an admin. RLS on and no policies: the browser's key can't read or change it.
create table public.admins (
  user_id uuid primary key references auth.users (id) on delete cascade
);
alter table public.admins enable row level security;

-- Add yourself (your user id is in Authentication > Users)
insert into public.admins (user_id) values ('your-user-id');

RLS on with no policies means the publishable key can’t read or change it. Only your server, with the secret key, can.

// app/api/admin/customers/route.ts: admin work, on the server
import { NextResponse } from 'next/server';
import { createClient } from '@/lib/supabase/server';
import { supabaseAdmin } from '@/lib/supabase/admin';

export async function GET() {
  // 1. Who is asking? getClaims() checks the session token's signature.
  const supabase = await createClient();
  const { data } = await supabase.auth.getClaims();
  const userId = data?.claims?.sub;
  if (!userId) return NextResponse.json({ error: 'Sign in first' }, { status: 401 });

  // 2. Are they an admin? Ask your own admins table.
  const { data: admin } = await supabaseAdmin
    .from('admins').select('user_id').eq('user_id', userId).maybeSingle();
  if (!admin) return NextResponse.json({ error: 'Admins only' }, { status: 403 });

  // 3. Only now do the admin job with the master key.
  const { data: customers, error } = await supabaseAdmin
    .from('customers').select('id, email, created_at');
  if (error) return NextResponse.json({ error: 'Could not load customers' }, { status: 500 });
  return NextResponse.json({ customers });
}

createClient comes from @/lib/supabase/server, the server client in Supabase’s Next.js SSR guide. Your admin page now fetches /api/admin/customers instead of calling Supabase with the master key.