Supabase database errorSupabase: “permission denied for schema auth”

Why the grant is ignored, and the fixes that work

1. 01

   The grant looks like it worked

   “On hosted Supabase, that grant has no effect.” Supabase, Permission errors when granting custom roles access to the auth schema

   Postgres only logs WARNING: no privileges were granted for "auth", and the SQL editor shows success. A grant of select on auth.users also succeeds, but the role still can’t reach the table without usage on the schema. grant execute on function auth.uid() changes nothing either, because every role already has it.

2. 02

   postgres can’t pass on a privilege it can’t grant

   “In Postgres, a role can grant a privilege only if it holds the privilege with the grant option.” Supabase, Permission errors when granting custom roles access to the auth schema

   supabase_admin owns the auth schema and supabase_auth_admin owns the tables and functions in it. postgres isn’t a superuser and can’t become either: grant supabase_auth_admin to postgres fails with "supabase_auth_admin" role memberships are reserved, only superusers can grant them, and set role supabase_auth_admin is denied. Remove the grant usage on schema auth lines from your migrations.

3. 03

   Check what the role can reach

   Run this in the SQL editor with your role’s name. can_execute_uid comes back true for every role. If auth_schema_usage is false, the role can’t reach anything in auth and auth.uid() fails, so use one of the three fixes below.

   select
     has_schema_privilege('my_role', 'auth', 'usage') as auth_schema_usage,
     has_function_privilege('my_role', 'auth.uid()', 'execute') as can_execute_uid;

4. 04

   Fix 1: read the user ID through a security definer function

   “Keep it in a schema that isn't exposed through the Data API.” Supabase, Permission errors when granting custom roles access to the auth schema

   The function runs as postgres, which can call auth.uid(), so your role only needs execute on it. Create it as postgres in a private schema, pin search_path and return only what the caller needs. This is Supabase’s example:

   create schema if not exists private;
   
   create or replace function private.current_user_id()
   returns uuid
   language sql
   security definer
   set search_path = ''
   stable as $$
     select auth.uid();
   $$;
   
   revoke all on function private.current_user_id() from public;
   grant usage on schema private to my_role;
   grant execute on function private.current_user_id() to my_role;

5. 05

   Fix 2: read the user ID from the JWT claims

   “auth.jwt() fails for a custom role in the same way as auth.uid().” Supabase, Permission errors when granting custom roles access to the auth schema

   auth.uid() reads the user ID from request settings the Data API sets from the user’s JWT. auth.jwt() fails for a custom role the same way, but your own function can read those settings with no access to auth and without security definer. Read another claim, such as role, with ->> 'role' on the same claims:

   create schema if not exists private;
   
   create or replace function private.request_user_id()
   returns uuid
   language sql
   stable
   set search_path = ''
   as $$
     select coalesce(
       nullif(current_setting('request.jwt.claim.sub', true), ''),
       (nullif(current_setting('request.jwt.claims', true), '')::jsonb ->> 'sub')
     )::uuid
   $$;
   
   grant usage on schema private to my_role;
   grant execute on function private.request_user_id() to my_role;

6. 06

   Fix 3: make the role a member of authenticated

   “Grant this membership only if the role needs all of that access.” Supabase, Permission errors when granting custom roles access to the auth schema

   grant authenticated to my_role gives the role usage on auth and every privilege signed-in users have, including your tables in public. A membership granted with inherit false doesn’t give usage on auth.

   grant authenticated to my_role;

7. 07

   Point policies and foreign keys at your own tables

   “A foreign key to auth.users needs access to the auth schema, so a table that a custom role owns can't have one.” Supabase, Permission errors when granting custom roles access to the auth schema

   With fix 1 or 2, the role still needs a grant on each table it uses and RLS policies written for it, such as to my_role using ( owner_id = (select private.current_user_id()) ). For a foreign key to the user, create your own profile table in a schema you control and reference it instead of auth.users. Then test as the role itself: the SQL editor runs as postgres and skips RLS.

Checked against the vendor’s docs on November 7, 2026: Supabase troubleshooting: Permission errors when granting custom roles access to the auth schema; Supabase docs: Database roles; PostgreSQL docs: GRANT (the grant option).

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

• from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
• from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.See scope and start

Related: Supabase “permission denied to change default privileges” · Supabase infinite recursion in RLS policy · Supabase select returns an empty array · Supabase AuthRetryableFetchError