Insert policies for write access in Supabase

Introduction

Insert policies control who can add new data to your database. They keep your data safe by allowing only the right users to write.

When you want only logged-in users to add new records.

When you want to allow users to add data only to their own account.

When you want to restrict data insertion to certain roles or groups.

When you want to prevent anonymous users from adding data.

When you want to audit or control who can create new entries.

Syntax

Supabase

CREATE POLICY policy_name ON table_name
FOR INSERT
WITH CHECK (condition);
-- or
CREATE POLICY policy_name ON table_name
FOR INSERT
USING (condition);

FOR INSERT means this policy applies when adding new data.

WITH CHECK controls which rows can be inserted; USING filters rows visible for the operation.

Examples

This policy lets only logged-in users add new messages.

Supabase

CREATE POLICY "Allow logged-in users to insert" ON messages
FOR INSERT
WITH CHECK (auth.uid() IS NOT NULL);

This policy allows users to insert data only if the user_id matches their own ID.

Supabase

CREATE POLICY "Users can insert their own data" ON profiles
FOR INSERT
WITH CHECK (user_id = auth.uid());

Sample Program

This setup creates a notes table where users can add notes only for themselves. The policy checks that the user_id in the new note matches the logged-in user's ID.

Supabase

CREATE TABLE notes (
  id SERIAL PRIMARY KEY,
  user_id UUID NOT NULL,
  content TEXT NOT NULL
);

-- Enable Row Level Security
ALTER TABLE notes ENABLE ROW LEVEL SECURITY;

-- Policy to allow logged-in users to insert notes only for themselves
CREATE POLICY "Insert own notes only" ON notes
FOR INSERT
WITH CHECK (user_id = auth.uid());

Important Notes

Always enable Row Level Security (RLS) on your table before adding policies.

Use auth.uid() to get the current user's ID in policies.

Test your policies carefully to avoid locking out all users.

Summary

Insert policies control who can add new data.

Use WITH CHECK to restrict what data can be inserted.

Enable RLS to activate policies on your tables.

Practice

1. What is the main purpose of an insert policy in Supabase?

easy

A. To create new tables in the database

B. To delete data from a table

C. To update existing data in a table

D. To control who can add new data to a table

Solution

1. Step 1: Understand insert policy role

   Insert policies define rules about who can add new rows to a table.

2. Step 2: Differentiate from other policies

   Delete and update policies control removing or changing data, not inserting.

3. Final Answer:

   To control who can add new data to a table -> Option D

4. Quick Check:

   Insert policy = control insert access [OK]

Hint: Insert policies control adding data only [OK]

Common Mistakes:

• Confusing insert with update or delete policies
• Thinking insert policies create tables
• Assuming insert policies control data reading

2. Which of the following is the correct syntax to create an insert policy in Supabase?

easy

A. CREATE POLICY "Insert policy" ON table_name FOR UPDATE TO public WITH CHECK (true);

B. CREATE POLICY "Insert policy" ON table_name FOR INSERT TO public USING (true);

C. CREATE POLICY "Insert policy" ON table_name FOR INSERT TO public WITH CHECK (true);

D. CREATE POLICY "Insert policy" ON table_name FOR DELETE TO public USING (true);

Solution

1. Step 1: Identify correct command for insert policy

   Insert policies use FOR INSERT and require WITH CHECK to validate new rows.

2. Step 2: Eliminate wrong options

   Options with FOR UPDATE or FOR DELETE are for other operations; USING is for row filtering on SELECT or DELETE.

3. Final Answer:

   CREATE POLICY "Insert policy" ON table_name FOR INSERT TO public WITH CHECK (true); -> Option C

4. Quick Check:

   Insert policy syntax uses WITH CHECK [OK]

Hint: Insert policies need WITH CHECK clause [OK]

Common Mistakes:

• Using FOR UPDATE or FOR DELETE instead of FOR INSERT
• Using USING instead of WITH CHECK for insert
• Omitting the TO clause

3. Given this insert policy:

CREATE POLICY "Allow user insert" ON messages FOR INSERT TO authenticated WITH CHECK (auth.uid() = user_id);

What happens if a user tries to insert a message with user_id different from their own auth.uid()?

medium

A. The insert fails because the WITH CHECK condition is not met

B. The insert succeeds but the user_id is overwritten automatically

C. The insert succeeds because the policy allows all authenticated users

D. The insert fails because the policy syntax is invalid

Solution

1. Step 1: Understand WITH CHECK condition

   The policy allows insert only if auth.uid() equals the user_id in the new row.

2. Step 2: Analyze user insert attempt

   If user_id differs from auth.uid(), the condition fails, so the insert is rejected.

3. Final Answer:

   The insert fails because the WITH CHECK condition is not met -> Option A

4. Quick Check:

   WITH CHECK enforces insert data validity [OK]

Hint: WITH CHECK must be true for insert to succeed [OK]

Common Mistakes:

• Assuming all authenticated users can insert any user_id
• Thinking Supabase overwrites user_id automatically
• Confusing WITH CHECK with USING clause

4. You wrote this insert policy:

CREATE POLICY "Insert policy" ON orders FOR INSERT TO public USING (true);

Why does this policy not allow any inserts?

medium

A. Because the TO clause should be 'authenticated' not 'public'

B. Because insert policies require WITH CHECK, not USING, to validate inserts

C. Because the policy name cannot contain spaces

D. Because RLS must be disabled for inserts to work

Solution

1. Step 1: Identify correct clause for insert validation

   Insert policies use WITH CHECK to validate new rows, not USING.

2. Step 2: Understand effect of USING clause

   USING filters rows for SELECT, UPDATE, DELETE but does not validate inserts.

3. Final Answer:

   Because insert policies require WITH CHECK, not USING, to validate inserts -> Option B

4. Quick Check:

   Insert policies need WITH CHECK, not USING [OK]

Hint: Use WITH CHECK for insert policies, not USING [OK]

Common Mistakes:

• Using USING instead of WITH CHECK for insert
• Thinking TO public disables inserts
• Believing RLS must be off for inserts

5. You want to allow users to insert rows only if the created_by column matches their user ID and the status column is always set to 'pending'. Which insert policy correctly enforces this?

hard

A. CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated WITH CHECK (created_by = auth.uid() AND status = 'pending');

B. CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated USING (created_by = auth.uid() AND status = 'pending');

C. CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated WITH CHECK (created_by = auth.uid());

D. CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated WITH CHECK (status = 'pending');

Solution

1. Step 1: Identify conditions for insert validation

   Both created_by must match auth.uid() and status must be 'pending' for insert to be allowed.

2. Step 2: Choose correct clause and conditions

   WITH CHECK is required for insert validation; USING is incorrect here.

3. Step 3: Verify all conditions included

   CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated WITH CHECK (created_by = auth.uid() AND status = 'pending'); includes both conditions combined with AND in WITH CHECK clause.

4. Final Answer:

   CREATE POLICY "User insert" ON tasks FOR INSERT TO authenticated WITH CHECK (created_by = auth.uid() AND status = 'pending'); -> Option A

5. Quick Check:

   Insert policy WITH CHECK enforces all conditions [OK]

Hint: Combine all insert conditions in WITH CHECK clause [OK]

Common Mistakes:

• Using USING instead of WITH CHECK for insert
• Checking only one condition, missing the other
• Forgetting to match user ID with auth.uid()