Supabase CLI stops auto-exposing new public schema objects
Introduced 2026-06-11 · score 0.93
HOW TO USE IT
When creating a `public` schema object that should be reachable through the Data API, add explicit `GRANT`s for the roles that need access. For temporary legacy behavior, set `[api].auto_expose_new_tables = true` in `config.toml`; the flag is deprecated and scheduled for removal.
GRANT SELECT ON public.<table_name> TO anon;
GRANT SELECT, INSERT, UPDATE, DELETE ON public.<table_name> TO authenticated;
GRANT SELECT, INSERT, UPDATE, DELETE ON public.<table_name> TO service_role;[api]
auto_expose_new_tables = trueWHY THIS HELPS
When creating public schema objects that should be accessible through the Data API, configure their intended role access.
BEFORE THIS CHANGE
New public-schema objects were automatically exposed through the Data API by default.
REQUIREMENTS AND LIMITATIONS
- Version: v2.106.0
- GRANT <privileges> ON <object> TO <role> (required): Give the named role the specified privileges on the object; choose privileges and roles according to intended access.
- [api].auto_expose_new_tables: When true, newly created public-schema objects are automatically reachable through the Data API roles; deprecated and scheduled for removal 2026-10-30.
- Prerequisite: Use a Supabase CLI version that supports `auto_expose_new_tables`; the official release discussion identifies v2.102.0 as the version that added the setting.
- Prerequisite: Enable RLS and add appropriate policies for exposed tables; grants and policies are separate access checks.
- When `[api].auto_expose_new_tables` is unset, it resolves to `false`.
- Local start/reset flows revoke default Data API privileges for newly-created tables, sequences, and functions in `public`.
- The deprecated `auto_expose_new_tables = true` setting is scheduled for removal.
FIRST-PARTY EVIDENCE
- https://github.com/supabase/cli/releases/tag/v2.106.0
- https://supabase.com/docs/guides/api/quickstart
- https://github.com/orgs/supabase/discussions/45329
Check the installed version and the source before using it. Entry JSON