Supabase + Transloadit

Build the integration

This Template imports a Supabase Storage object, resizes it, and writes the result into the same bucket under processed/.

1. Enable the Supabase Storage S3 endpoint and generate server-side access keys.
2. Save the S3 connection values as Template Credentials named my_supabase_credentials.
3. Paste the Instructions into a Template and start an Assembly from that Template.

{
  "steps": {
    "imported": {
      "robot": "/supabase/import",
      "credentials": "my_supabase_credentials",
      "path": "incoming/photo.jpg"
    },
    "resized": {
      "robot": "/image/resize",
      "use": "imported",
      "width": 1200,
      "height": 1200,
      "resize_strategy": "fit"
    },
    "exported": {
      "robot": "/supabase/store",
      "use": "resized",
      "credentials": "my_supabase_credentials",
      "path": "processed/${file.url_name}"
    }
  }
}

Authentication

• Generate S3 access keys in the Supabase Storage S3 settings and copy the endpoint and region from the same screen.
• Save the bucket, direct storage endpoint, region, Access Key ID, and Secret Access Key as Transloadit Template Credentials.
• Treat these values as server credentials. Supabase states that generated S3 access keys bypass Row Level Security.
• For per-user exports, /supabase/store can pass a Supabase user JWT in session_token alongside the project reference and anon key so Supabase can apply Row Level Security.

Limitations and operational notes

• Generated S3 access keys provide broad server-side access across Storage buckets and bypass RLS policies. Scope the Transloadit workflow with its bucket and path configuration.
• JWT session-token authentication is available for /supabase/store. /supabase/import still uses S3 access-key authentication.
• Use the direct storage hostname recommended by Supabase for large files instead of the project API hostname.