new row violates row-level security policy for table

What it means in plain English

Supabase refused to save a new or updated row because your security rules (RLS) don't allow that user to create it.

Likely causes

• No INSERT (or UPDATE) policy exists on the table.
• The policy's with check requires user_id = auth.uid() but your app doesn't send user_id, or sends a different value.
• The user isn't signed in, so auth.uid() is null.
• An UPDATE has no matching SELECT policy; Supabase notes UPDATE needs a SELECT policy to work.

How to fix it, step by step

1. Supabase → Database → Policies, find the table.
2. Add an INSERT policy, e.g.:

create policy "Users can create their own rows"
on public.todos for insert
to authenticated
with check ( (select auth.uid()) = user_id );

3. For edits, add both an UPDATE policy (using + with check) and a SELECT policy.
4. Make the app set user_id to the signed-in user's id when inserting (or give the column a default of auth.uid()).
5. Confirm the user is signed in before saving.
6. If uploading files, see the separate Supabase Storage page: Storage uses its own storage.objects policies.

How to check it worked

• Submit the form again; the row should save and appear in Table Editor.
• Try saving while signed out; it should still be refused.

Sources

• https://supabase.com/docs/guides/database/postgres/row-level-security (opens in a new tab)
• https://supabase.com/docs/guides/api/securing-your-api (opens in a new tab)