Opening SELECT to completely unauthenticated requests

[PierreMesure]

Problem

I'd like to use PostgREST/Supabase to expose open data, e.g. data that should be freely available for download by anyone. I understand the need to protect from INSERT queries for instance. But I would like to open SELECT GET requests completely and as far as I understand, there is no way to do this right now?

Solution

Not sure how that could be done using the current architecture. Maybe a new anonymous user?

[wolfgangwalther]

You are looking for db-anon-role. Set this to the role of your database user for anonymous access. Only GRANT SELECT on the respective tables to this user.

You can grant any modification (INSERT etc.) privileges only to a privileged user, which needs to authenticate to do those things.

[PierreMesure]

Thanks a lot @wolfgangwalther! And sorry for asking such a basic question. I did read about this role but since I'm currently testing Supabase and it's requiring an API key to use it, I did not understand that it was completely open using PostgREST.

I'll ask my question in the Supabase repo and consider migrating to PostgREST only.