# Supabase: “permission denied for table” (42501)
> Supabase returns 42501 permission denied for table: the role has no grant on it. Check the grants, add the one you need, and keep RLS on to protect the rows.
Canonical: https://app369.com/fix/supabase-permission-denied-for-table/
Last updated: 2026-11-09
“permission denied for table” is Postgres error 42501, raised when the role making the request has no privilege on the table. In Supabase that role is anon or authenticated, and the request fails before any RLS policy runs. Add the missing grant, then keep RLS on.
**Short answer**
Run the grants query below to see what anon and authenticated may do on the table, then grant only what the app needs, such as select to anon or select, insert, update and delete to authenticated. Keep RLS on with policies, because the grant opens the table to the API. If the error names a sequence, column or schema, see the matching cause below.
Rather not fix it yourself? [**App Fix Ticket**](https://app369.com/fixed-price/flutter-firebase-bug-fix/) starts with a fixed-price diagnosis, then a fixed price for the fix before any fix work.
## **Why the role is denied, and the fix**
1. 01 ### **The table has no grant for the API roles**
> “A table isn't reachable through the Data API unless you have granted a role privileges on it.” [**Supabase, Securing your API**](https://supabase.com/docs/guides/api/securing-your-api) Tables made with Automatically expose new tables turned off, or after a revoke in SQL, have no privileges for anon or authenticated. The error’s hint names the exact grant statement. Check, then grant.```
-- what anon and authenticated may do now
select grantee, privilege_type
from information_schema.role_table_grants
where table_schema = 'public' and table_name = 'your_table'
and grantee in ('anon', 'authenticated');
-- RLS and a policy first (example policy), then the grant
alter table public.your_table enable row level security;
create policy "own rows" on public.your_table for select to authenticated
using (user_id = (select auth.uid()));
grant select, insert, update, delete on table public.your_table to authenticated;
```
2. 02 ### **The grant opens the table, so keep RLS on**
> “Granting privileges allows access to your table through the Data API, so you should ensure you enable RLS and write appropriate policies to protect your data.” [**Supabase, Database API 42501 errors**](https://supabase.com/docs/guides/troubleshooting/database-api-42501-errors) A grant lets the role reach every row. Turn RLS on and write policies before you grant, so the grant and the policies land in the same migration.
3. 03 ### **select * reads a restricted column**
> “This includes using select *, as it expands to include forbidden columns.” [**Supabase, Database API 42501 errors**](https://supabase.com/docs/guides/troubleshooting/database-api-42501-errors) If some columns are limited to certain roles, select * asks for them too and fails. Name the columns the app needs.
4. 04 ### **The table is in auth, vault or a custom schema**
> “API roles cannot access certain schemas, most notably auth and vault.” [**Supabase, Database API 42501 errors**](https://supabase.com/docs/guides/troubleshooting/database-api-42501-errors) The API roles can’t read auth or vault, by design. Keep the data you need in a public table, such as profiles. A custom schema has to be exposed in the API settings and granted to the roles.
5. 05 ### **Inserts fail with permission denied for sequence** A serial id uses a sequence, and inserting needs usage on it too. Grant usage on the sequence, or use an identity column.```
grant usage, select on sequence public.your_table_id_seq to authenticated;
```
Checked against the vendor’s docs on November 9, 2026: [Supabase troubleshooting: Database API 42501 errors](https://supabase.com/docs/guides/troubleshooting/database-api-42501-errors); [Supabase docs: Securing your API](https://supabase.com/docs/guides/api/securing-your-api).
## **Rather hand it over?**
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- [from $450**App Fix Ticket**One reproducible bug in an existing mobile or web app, diagnosed and fixed.**See scope and start**](https://app369.com/fixed-price/flutter-firebase-bug-fix/)
- [from $450**AI-Built App Rescue**A Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.****No issues worth fixing, no charge.**** If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.**See scope and start**](https://app369.com/fixed-price/ai-app-rescue/)
[**All 127 Fiverr reviews**](https://app369.com/reviews/)
Related: [**Supabase “new row violates row-level security policy”**](https://app369.com/fix/supabase-new-row-violates-row-level-security/) · [**Supabase permission denied for schema auth**](https://app369.com/fix/supabase-permission-denied-for-schema-auth/) · [**Supabase anon key exposed**](https://app369.com/fix/supabase-anon-key-exposed/) · [**Supabase permission denied to change default privileges**](https://app369.com/fix/supabase-permission-denied-to-change-default-privileges/)
Questions
## **More on this error**
**Why does the app see a 401 or 403? **+
Supabase says 42501 errors often reach clients as 401 or 403 errors. The Postgres code in the error body is the one to look up.
**Is this the same as “new row violates row-level security policy”? **+
No. Permission denied means the role has no grant on the table at all. New row violates means the grant exists but an RLS policy refused the write. That page covers the second case.
**Can you fix it for me? **+
If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way. This applies to the first 10 Launch Checks bought after October 30, 2026.
A different error?
## **Describe it and get a written quote**
Send the error and what you were doing. You get a written scope, a fixed price and a timeline; Simon replies by email, usually within one business day.
[**Describe your problem **→](https://app369.com/contact/) [**All fixes**](https://app369.com/fix/)