Introducing Supabase Middleware

[wendeh]

@supabase/middleware is composable, type-safe middleware for Web Fetch handlers. You write per-request logic once and run it on any runtime that supports fetch, or inside Hono, H3, Elysia, NestJS, and TanStack Start with a short bridge you copy. Available now.

What changed

@supabase/server has covered the setup step since May, but the per-request logic you add on top, like flag checks, CORS, and what a request needs before your code runs, stays in the handler where you wrote it. Change runtimes and you write it again. Adopt a framework and you rewrite it as that framework's middleware. withSupabase now runs on the @supabase/middleware engine, and @supabase/server ships standalone middleware for each concern that you can combine and reuse.

What's included

• defineMiddleware writes one piece of per-request logic. It's the same API the Supabase middleware use, and you can publish yours as a package
• pipeline([...], handler) runs middleware in order. Each adds one typed key to a shared ctx, and duplicate keys or a middleware ordered before its prerequisite fail to compile on TypeScript 5.4+
• Any middleware can return a Response and stop the chain, or modify the response on the way out
• Runs on Supabase Edge Functions, Vercel Functions, Cloudflare Workers, Deno, Bun, and Node 22+. Bridges for Hono, H3, Elysia, NestJS, and TanStack Start are a file you copy, not a package
• The Supabase set (withClaims, withRequiredClaims, withSupabaseClient, withSupabaseAdminClient, withPostgresClient, withPostgresAdminClient, withOAuthProtectedResource) imports from @supabase/server subpaths, and withCors and withFeatureFlag ship with the engine. withPostgresClient and withPostgresAdminClient need a TCP socket, so they don't run on Workers
• withOAuthProtectedResource plus withSupabase gives your app its own MCP server that an agent calls as the signed-in user, with your RLS policies applied

Getting started

• Install: npm install @supabase/middleware
• Blog: https://supabase.com/blog/supabase-middleware
• API reference: https://supabase.com/docs/reference/middleware/introduction
• Repo: https://github.com/supabase/middleware
• Guides: authoring guide, frameworks guide, and bring your own MCP guide

Feedback welcome

Reply here with what you're building, or anything that was unclear when you set it up.