Replit + Powabase

Example apps

Real apps, each from one prompt. Copy any of them and give it to Replit.

Where Replit keeps your keys

Replit keeps keys in the Secrets pane, encrypted with AES-256 at rest, and exposes each one to your app as an environment variable: process.env.API_KEY in Node, os.getenv("API_KEY") in Python. Put BASE_URL and the Service Role key under App Secrets so they belong to this app only; Account Secrets are for values you want to link across several apps. Someone who remixes your app without being a collaborator sees the secret names but not the values. Only server code should read the Service Role key.

Replit example

// A route the Agent writes. The browser calls /api/search, never Powabase.
app.use(express.json()); // needed for req.body
app.post("/api/search", async (req, res) => {
  const key = process.env.API_KEY; // Secret: Service Role (Secret) Key
  const url = `${process.env.BASE_URL}/api/knowledge-bases/${process.env.KB_ID}/search`;
  const r = await fetch(url, {
    method: "POST",
    headers: {
      apikey: key,
      Authorization: `Bearer ${key}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ query: req.body.query, top_k: 5 }),
  });
  if (!r.ok) return res.status(r.status).json({ error: "search failed" });
  const { results } = await r.json();
  res.json(results);
});

KB_ID is a third App Secret holding your knowledge base's ID. The same route works in any Replit deployment that runs a server. Before this goes live, check the caller is a signed-in user so strangers can't spend your key.

Connecting to Powabase from any tool

Mechanics that don’t change from tool to tool.

• Every call to /api/* or /rest/v1/* needs two headers, apikey and Authorization: Bearer, both set to the same key. Sending only one is the most common cause of a 401.

  Docs↗

• The Database URL from the Connect modal is PgBouncer in transaction mode, not a direct Postgres connection. Disable prepared statements in your driver, or you'll hit prepared statement "..." does not exist. No LISTEN/NOTIFY and no session-level SET across statements. Use Realtime for change notifications; SET LOCAL inside a transaction otherwise. The username and database in the URL are both your project ref, not postgres.

  Docs↗

• @supabase/supabase-js mostly works for the BaaS surface (PostgREST, Auth, Storage, Realtime) when you point it at your project URL with the Anon key. It doesn't cover the /api/* AI surface (agents, knowledge bases, orchestrations), which you call over plain REST. There's no /graphql/v1 route: point any GraphQL client at POST /rest/v1/rpc/graphql instead.

  Docs↗

Common errors

Your Secrets are undefined after you publish

Cause: The app was published as a Static Deployment, which is the one deployment type that doesn't get Secrets.

Fix: Publish with a deployment type that runs your server, and keep the Powabase calls in that server code.

The app saves data, but none of it appears in Powabase

Cause: The Agent added Replit's own database, which creates a DATABASE_URL secret, and the generated code writes there.

Fix: Tell the Agent to use Powabase for data. If you connect over Postgres, store the Powabase Database URL under its own name, such as POWABASE_DATABASE_URL, so the two never collide.

401 Unauthorized

Cause: Only one of the apikey / Authorization headers was sent.

Fix: Send both, set to the same key. Docs↗

prepared statement "..." does not exist

Cause: PgBouncer's transaction-mode pooler moved you to a different server connection.

Fix: Disable prepared statements in your driver's config. Docs↗

A query that should return rows comes back empty, or a write is silently rejected

Cause: Row Level Security on your own tables. New public tables ship with RLS off, but once you add policies they gate every request.

Fix: Check the policy's USING/WITH CHECK clause and confirm which role (anon, authenticated, service_role) you actually authenticated as. Docs↗

The Service Role key turns up in a browser bundle or other client-visible code

Cause: It was used somewhere that ships to the client instead of staying server-side.

Fix: Move the call server-side; use the Anon key with RLS for anything client-visible. If it shipped, rotate it in Studio. Docs↗

FAQ