| name | supabase-webhooks-events |
| description | Implement Supabase database webhooks, pg_net async HTTP, LISTEN/NOTIFY,
and Edge Function event handlers with signature verification.
Use when setting up database webhooks for INSERT/UPDATE/DELETE events,
sending HTTP requests from PostgreSQL triggers, handling Realtime
postgres_changes as an event source, or building event-driven architectures.
Trigger with phrases like "supabase webhook", "database events",
"pg_net trigger", "supabase LISTEN NOTIFY", "webhook signature verify",
"supabase event-driven", "supabase_functions.http_request".
|
| allowed-tools | Write, Bash(supabase:*), Bash(curl:*), Bash(psql:*) |
| version | 1.53.0 |
| license | MIT |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| tags | ["saas","supabase","webhooks","events","triggers","pg_net","realtime"] |
| compatibility | Designed for Claude Code, also compatible with Codex and OpenClaw |
Supabase Webhooks & Database Events
Overview
Supabase offers four complementary event mechanisms: Database Webhooks (trigger-based HTTP calls via pg_net), supabase_functions.http_request() (call Edge Functions from triggers), Postgres LISTEN/NOTIFY (lightweight pub/sub), and Realtime postgres_changes (client-side event subscriptions). This skill covers all four patterns with production-ready code including signature verification, idempotency, and retry handling.
Prerequisites
- Supabase project (local or hosted) with
supabase CLI installed
pg_net extension enabled: Dashboard > Database > Extensions > search "pg_net" > Enable@supabase/supabase-js v2+ installed for client-side patterns- Edge Functions deployed for webhook receiver patterns
Authentication
Both directions of a webhook are authenticated:
- Outbound (trigger → Edge Function): the trigger sends an
Authorization: Bearer <service_role_key> header. Store the key in a Postgres setting (app.settings.service_role_key) or Supabase Vault — never inline it in a committed migration.
- Inbound (Edge Function receiver): verify an HMAC-SHA256 signature against a shared
WEBHOOK_SECRET (read from Deno.env) using a constant-time comparison, and reject mismatches with 401. See signature-verification.md.
Instructions
Pick the mechanism that fits the consumer: pg_net triggers for server-side HTTP fan-out, Edge Function receivers for signed processing, LISTEN/NOTIFY for in-database pub/sub, and Realtime for client UI. Write each SQL trigger to a supabase/migrations/ file and each handler to supabase/functions/<name>/index.ts, then apply and deploy with the supabase CLI.
Step 1 — Database Webhooks with pg_net and Trigger Functions
Enable pg_net, then write a trigger function that POSTs the changed row to an Edge Function. Attach it AFTER INSERT/UPDATE/DELETE. Full trigger set (conditional status-change trigger, the supabase_functions.http_request() built-in helper, and net._http_response inspection queries) is in .
