JavaScript client installation in Supabase - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Supabase Client Initialization

You want to initialize the Supabase JavaScript client in your web app. Which option correctly creates the client instance?

A const supabase = new SupabaseClient('https://xyzcompany.supabase.co', 'public-anon-key');

B const supabase = createClient('https://xyzcompany.supabase.co', 'public-anon-key');

C const supabase = supabase.createClient('https://xyzcompany.supabase.co', 'public-anon-key');

D const supabase = supabaseClient('https://xyzcompany.supabase.co', 'public-anon-key');

💡 Hint

Check the official Supabase docs for the exact function name to create a client.

The Supabase JavaScript client is created using the createClient function imported from '@supabase/supabase-js'. The other options use incorrect function or constructor names.

❓ Configuration

intermediate

Correct npm Package for Supabase Client

You want to install the Supabase JavaScript client in your project. Which npm command installs the official package?

A npm install supabase-js

B npm install supabase

C npm install supabase-client

D npm install @supabase/supabase-js

💡 Hint

Look for the package name that starts with '@supabase'.

The official Supabase JavaScript client package is named '@supabase/supabase-js'. Other package names are incorrect or unofficial.

❓ Architecture

advanced

Best Practice for Storing Supabase Keys

In a client-side JavaScript app, where should you store your Supabase public anon key and service role key?

A Store the public anon key in client code, keep the service role key only on the server.

B Store both keys in environment variables and expose them to the client.

C Embed both keys directly in the client JavaScript code.

D Store both keys in a public JSON file loaded by the client.

💡 Hint

Think about which keys are safe to share publicly and which must be kept secret.

The public anon key is safe to include in client code because it has limited permissions. The service role key has full access and must be kept secret on the server only.

❓ service_behavior

advanced

Supabase Client Behavior on Network Failure

What happens when the Supabase JavaScript client tries to fetch data but the network is offline?

A The client silently ignores the request and returns empty data.

B The client automatically retries the request indefinitely until the network is back.

C The client throws an error immediately and does not retry the request.

D The client queues the request and sends it when the network is restored.

💡 Hint

Consider how typical HTTP clients behave on network failure.

The Supabase client throws an error immediately on network failure. It does not retry or queue requests automatically.

❓ security

expert

Preventing Unauthorized Access with Supabase Client

You want to restrict access to certain database rows based on the logged-in user using the Supabase JavaScript client. Which approach correctly enforces this?

A Use Row Level Security (RLS) policies on the Supabase database and authenticate users with the client.

B Filter data on the client side after fetching all rows from the database.

C Store user IDs in localStorage and filter queries based on that without server policies.

D Use the service role key in the client to bypass restrictions and filter manually.

💡 Hint

Think about where security enforcement should happen: client or server?

Row Level Security (RLS) policies on the database enforce access control securely. Client-side filtering or using the service role key in the client is insecure.