Supabase Storage upload fails: new row violates row-level security policy

What it means in plain English

Supabase Storage keeps file records in a table called storage.objects, protected by its own security rules. Without a rule allowing uploads, every upload is refused.

Likely causes

• No INSERT policy on storage.objects for your bucket.
• Using upsert: true without SELECT and UPDATE policies too.
• User not signed in.

How to fix it, step by step

1. Supabase → Storage → Policies → your bucket → New policy.
2. Allow signed-in users to upload, e.g. only into their own folder:

create policy "Users upload to own folder"
on storage.objects for insert to authenticated
with check ( bucket_id = 'avatars' and (storage.foldername(name))[1] = (select auth.jwt()->>'sub') );

3. If you overwrite files (upsert), also add SELECT and UPDATE policies.
4. For public images, mark the bucket public or add a SELECT policy.

How to check it worked

• Upload a file from the live site; it appears in the bucket.
• Signed-out upload is refused.

Sources

• https://supabase.com/docs/guides/storage/security/access-control (opens in a new tab)
• https://supabase.com/docs/guides/database/postgres/row-level-security (opens in a new tab)