Supabase RPC Studio

Background

The problem

Testing a function as different roles usually means writing scripts or juggling headers in an API client. It's easy to get the headers slightly wrong and test the wrong thing, and easy to skip the check entirely.

• Each role needs a different combination of Authorization and apikey headers
• There's no quick list of which functions a role can actually see
• Finding a function's required parameters means reading the schema
• Testing mixed cases, like listing as anon but calling as a user, is fiddly

Solution

What we built

A single-page React app. Paste the project URL and anon key once, optionally sign in with email and password, and pick a mode: Session, Anon or No token. The explorer reads the project's OpenAPI description, so it only lists the functions that mode is allowed to see. Pick one and the runner fills in a payload with its required fields.

• Three auth modes, with the right headers set automatically for each
• A function list read from PostgREST's OpenAPI schema, filtered by permission
• Required and optional parameters, with types, enums, defaults and nullability
• A prefill button that builds a minimal payload from the required fields
• Results with HTTP status, duration, row count and size
• Linked or separate modes for the explorer and runner, to test mixed cases
• Config and session kept in the browser only, and it never asks for the service key

In use

What it looks like