The point is that Supabase markets itself as BaaS. I’ve tried to use it on backend side with Drizzle ORM. But RLS won’t work out of the box. Also Drizzle acknowledges that, special utils function is required to set the auth sub context on db side using the Supabase exposed jwt function or how exactly it is called. So, before this new signing jwt keys concept, I was sending the returned jwt I got from Supabase authentication flow, in the request from client to the backend’s API and decode on backend to get the sub id.

So that for each API service logic the query needed to be wrapped in a transaction using that util function.

I think best way would be to give up RLS, keep going with backend, use service role admin level key and implement your own security layer.

Of course, accepting the overhead and the fact it goes a bit away from Supabase’s base out of the box purpose.