Bolt.new + Powabase

Example apps

Real apps, each from one prompt. Copy any of them and give it to Bolt.new.

Where Bolt.new keeps your keys

Bolt keeps secrets in the Secrets tab of its database panel (the database icon at the top center of a project), and only server functions can read them. That's where BASE_URL and the Service Role key belong, with a server function making the Powabase calls. A .env value prefixed VITE_ is bundled into the browser by Vite, so the Anon key is the only Powabase key that can live there. People you share a project with as viewers never see its environment variables.

Bolt.new example

// The browser calls this server function; only the function talks to Powabase.
const cors = {
  "Access-Control-Allow-Origin": "*",
  "Access-Control-Allow-Methods": "POST, OPTIONS",
  "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
};

Deno.serve(async (req) => {
  if (req.method === "OPTIONS") return new Response(null, { headers: cors });
  const { query } = await req.json();
  const key = Deno.env.get("API_KEY")!; // Secret: Service Role (Secret) Key
  const url = `${Deno.env.get("BASE_URL")}/api/knowledge-bases/${Deno.env.get("KB_ID")}/search`;
  const res = await fetch(url, {
    method: "POST",
    headers: { apikey: key, Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
    body: JSON.stringify({ query, top_k: 5, retrieval_method: "hybrid" }),
  });
  const headers = { ...cors, "Content-Type": "application/json" };
  return new Response(await res.text(), { status: res.status, headers });
});

This is written in the Deno edge-function style. If your project's server functions look different, ask Bolt to port the fetch, which is the part that matters. The CORS headers are a superset of the ones in Bolt's troubleshooting guide, so a frontend calling through supabase.functions.invoke gets through. KB_ID is a third Secret holding your knowledge base's ID. Before this goes live, check the caller is a signed-in user so strangers can't spend your key.

Connecting to Powabase from any tool

Mechanics that don’t change from tool to tool.

• Every call to /api/* or /rest/v1/* needs two headers, apikey and Authorization: Bearer, both set to the same key. Sending only one is the most common cause of a 401.

  Docs↗

• The Database URL from the Connect modal is PgBouncer in transaction mode, not a direct Postgres connection. Disable prepared statements in your driver, or you'll hit prepared statement "..." does not exist. No LISTEN/NOTIFY and no session-level SET across statements. Use Realtime for change notifications; SET LOCAL inside a transaction otherwise. The username and database in the URL are both your project ref, not postgres.

  Docs↗

• @supabase/supabase-js mostly works for the BaaS surface (PostgREST, Auth, Storage, Realtime) when you point it at your project URL with the Anon key. It doesn't cover the /api/* AI surface (agents, knowledge bases, orchestrations), which you call over plain REST. There's no /graphql/v1 route: point any GraphQL client at POST /rest/v1/rpc/graphql instead.

  Docs↗

Common errors

CORS error in the browser console when the app calls your server function

Cause: The function doesn't answer the browser's OPTIONS preflight or doesn't send Access-Control-Allow-* headers.

Fix: Return the CORS headers on every response and handle OPTIONS, as in the example above. Bolt's Plan mode can check this for you.

The preview goes blank after you add the Powabase call

Cause: A variable the code expects, such as BASE_URL, isn't set. Bolt previews often show a white screen when required variables are missing.

Fix: Ask Bolt to list every environment variable the project needs, then add the server-side ones, BASE_URL and API_KEY, in Secrets.

The Service Role key is readable in the browser

Cause: It was put in .env as a VITE_ variable, and Vite bundles those into client code.

Fix: Move it to Secrets under a name without the VITE_ prefix and read it only in a server function. If it shipped, rotate it in Studio.

401 Unauthorized

Cause: Only one of the apikey / Authorization headers was sent.

Fix: Send both, set to the same key. Docs↗

prepared statement "..." does not exist

Cause: PgBouncer's transaction-mode pooler moved you to a different server connection.

Fix: Disable prepared statements in your driver's config. Docs↗

A query that should return rows comes back empty, or a write is silently rejected

Cause: Row Level Security on your own tables. New public tables ship with RLS off, but once you add policies they gate every request.

Fix: Check the policy's USING/WITH CHECK clause and confirm which role (anon, authenticated, service_role) you actually authenticated as. Docs↗

FAQ