Supabase Row-Level Security 403 Forbidden Error

1. RLS policy checking wrong user ID or role field
2. Auth context not properly passed from client to Supabase queries
3. Policy using user_id that doesn't match session user
4. Service role key used in client code instead of anon/user key
5. Public read policy missing or disabled when needed

Check auth session: Ensure Supabase session available before querying: const { data: { session } } = await supabase.auth.getSession()

Test RLS policy: In Supabase dashboard, check Policy editor. Manually test with different user roles to verify policy logic.

Simple policy to start: Create permissive read policy: CREATE POLICY "allow_read" ON table FOR SELECT TO authenticated USING (true); to test connectivity.

Verify user context: Policies see auth.uid() as current user. Ensure your policy checks against correct field matching this user.