v0 + Powabase

Example apps

Real apps, each from one prompt. Copy any of them and give it to v0.

Where v0 keeps your keys

v0 keeps keys as Vercel environment variables, under Project menu → Settings → Environment Variables, encrypted and scoped to Production, Preview, and Development. The v0 preview panel only sees Development values. Add BASE_URL and the Service Role key without a NEXT_PUBLIC_ prefix so Next.js keeps them on the server for server actions and route handlers. Only the Anon key may carry NEXT_PUBLIC_, because anything with that prefix is inlined into the browser bundle at build time.

v0 example

"use server";

export async function askAgent(message: string, sessionId?: string) {
  const key = process.env.API_KEY!; // Service Role (Secret) Key, no NEXT_PUBLIC_
  const res = await fetch(
    `${process.env.BASE_URL}/api/agents/${process.env.AGENT_ID}/run`,
    {
      method: "POST",
      headers: { apikey: key, Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
      body: JSON.stringify({ message, session_id: sessionId }),
      cache: "no-store",
    },
  );
  if (!res.ok) throw new Error(`Agent run failed: ${res.status}`);
  return res.json(); // reply plus session_id for the next turn
}

AGENT_ID is a third environment variable with your agent's ID. A client component can import and call askAgent directly; the fetch and the key stay on the server. Before this goes live, check the caller is a signed-in user so strangers can't spend your key.

Connecting to Powabase from any tool

Mechanics that don’t change from tool to tool.

• Every call to /api/* or /rest/v1/* needs two headers, apikey and Authorization: Bearer, both set to the same key. Sending only one is the most common cause of a 401.

  Docs↗

• The Database URL from the Connect modal is PgBouncer in transaction mode, not a direct Postgres connection. Disable prepared statements in your driver, or you'll hit prepared statement "..." does not exist. No LISTEN/NOTIFY and no session-level SET across statements. Use Realtime for change notifications; SET LOCAL inside a transaction otherwise. The username and database in the URL are both your project ref, not postgres.

  Docs↗

• @supabase/supabase-js mostly works for the BaaS surface (PostgREST, Auth, Storage, Realtime) when you point it at your project URL with the Anon key. It doesn't cover the /api/* AI surface (agents, knowledge bases, orchestrations), which you call over plain REST. There's no /graphql/v1 route: point any GraphQL client at POST /rest/v1/rpc/graphql instead.

  Docs↗

Common errors

Works once deployed, but the v0 preview says the key is missing

Cause: The v0 preview only reads variables that are available to the Development environment.

Fix: Edit BASE_URL and API_KEY in Settings → Environment Variables and tick Development as well as Production and Preview.

The Service Role key is readable in the browser's JavaScript

Cause: It was named with a NEXT_PUBLIC_ prefix, which tells Next.js to inline it into the client bundle at build time.

Fix: Rename it without the prefix, read it only in server actions or route handlers, and redeploy. If it shipped, rotate it in Studio.

401 Unauthorized

Cause: Only one of the apikey / Authorization headers was sent.

Fix: Send both, set to the same key. Docs↗

prepared statement "..." does not exist

Cause: PgBouncer's transaction-mode pooler moved you to a different server connection.

Fix: Disable prepared statements in your driver's config. Docs↗

A query that should return rows comes back empty, or a write is silently rejected

Cause: Row Level Security on your own tables. New public tables ship with RLS off, but once you add policies they gate every request.

Fix: Check the policy's USING/WITH CHECK clause and confirm which role (anon, authenticated, service_role) you actually authenticated as. Docs↗

FAQ