Base44 + Powabase

Example apps

Real apps, each from one prompt. Copy any of them and give it to Base44.

Where Base44 keeps your keys

Base44 stores API keys as Secrets in the app dashboard and hands them only to backend functions, the TypeScript code under Dashboard → Code → Functions. Put BASE_URL and the Service Role key there and have a backend function make every Powabase call; the frontend Base44 builds should call that function, not Powabase. Backend functions need a Builder plan or higher. When you replace a key, preview picks it up right away, but the live app only uses it after you publish again.

Base44 example

import { createClientFromRequest } from "npm:@base44/sdk";
import { secrets } from "base44:runtime";

export default async function (req: Request): Promise<Response> {
  const user = await createClientFromRequest(req).auth.me();
  if (!user) return Response.json({ error: "Unauthorized" }, { status: 401 });

  const { message } = await req.json();
  const key = secrets.get("API_KEY")!; // Service Role (Secret) Key
  const url = `${secrets.get("BASE_URL")}/api/agents/${secrets.get("AGENT_ID")}/run`;
  const res = await fetch(url, {
    method: "POST",
    headers: { apikey: key, Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
    body: JSON.stringify({ message }),
  });
  return new Response(await res.text(), {
    status: res.status,
    headers: { "Content-Type": "application/json" },
  });
}

Backend functions run on Deno. This one only answers signed-in users of your Base44 app, and it reads secrets inside the handler because they resolve per request.

Connecting to Powabase from any tool

Mechanics that don’t change from tool to tool.

• Every call to /api/* or /rest/v1/* needs two headers, apikey and Authorization: Bearer, both set to the same key. Sending only one is the most common cause of a 401.

  Docs↗

• The Database URL from the Connect modal is PgBouncer in transaction mode, not a direct Postgres connection. Disable prepared statements in your driver, or you'll hit prepared statement "..." does not exist. No LISTEN/NOTIFY and no session-level SET across statements. Use Realtime for change notifications; SET LOCAL inside a transaction otherwise. The username and database in the URL are both your project ref, not postgres.

  Docs↗

• @supabase/supabase-js mostly works for the BaaS surface (PostgREST, Auth, Storage, Realtime) when you point it at your project URL with the Anon key. It doesn't cover the /api/* AI surface (agents, knowledge bases, orchestrations), which you call over plain REST. There's no /graphql/v1 route: point any GraphQL client at POST /rest/v1/rpc/graphql instead.

  Docs↗

Common errors

Asking the AI chat for a Powabase integration doesn't produce a backend function

Cause: Backend functions need a Builder plan or higher.

Fix: Upgrade the plan, then ask again: name the Powabase endpoints you need and say the key should be stored as a Secret.

secrets.get("API_KEY") returns undefined

Cause: It's called at the top level of the module. Secrets resolve per request, so a read at module load happens before any are available.

Fix: Move the secrets.get calls inside the handler.

Preview works with your new key, but the published app still fails

Cause: A replaced secret applies to building and previewing straight away, but the published version keeps the old value.

Fix: Publish the app again.

401 Unauthorized

Cause: Only one of the apikey / Authorization headers was sent.

Fix: Send both, set to the same key. Docs↗

prepared statement "..." does not exist

Cause: PgBouncer's transaction-mode pooler moved you to a different server connection.

Fix: Disable prepared statements in your driver's config. Docs↗

A query that should return rows comes back empty, or a write is silently rejected

Cause: Row Level Security on your own tables. New public tables ship with RLS off, but once you add policies they gate every request.

Fix: Check the policy's USING/WITH CHECK clause and confirm which role (anon, authenticated, service_role) you actually authenticated as. Docs↗

The Service Role key turns up in a browser bundle or other client-visible code

Cause: It was used somewhere that ships to the client instead of staying server-side.

Fix: Move the call server-side; use the Anon key with RLS for anything client-visible. If it shipped, rotate it in Studio. Docs↗

FAQ