First things first, head over to Supabase and either sign up or log in. Once you're in, create a new project. Don't forget to save the URL and API keys they give you. You'll need those later.

Next, go to the "Settings" tab of your new Supabase project. Then, find the "API" section. Here, you'll see the "JWT Secret." Make a note of this value because you'll need it to verify and decode the JWTs.

To add custom claims to your JWT, you'll need to tweak the authentication logic of your app. This is usually done on the backend. If you're using Node.js, it might look something like this:

const jwt = require('jsonwebtoken');

// Assume supabaseKey and supabaseSecret are your Supabase project key and secret
const supabaseKey = process.env.SUPABASE_KEY;
const supabaseSecret = process.env.SUPABASE_JWT_SECRET;

// Function to sign a JWT with custom claims
function signJWT(payload) {
    const customClaims = {
        // Add your custom claims here
        'https://myapp.com/jwt/claims': {
            'role': 'admin',
            'user_id': payload.id
        }
    };
    return jwt.sign(customClaims, supabaseSecret);
}

// Example usage
const userPayload = { id: '1234', email: '[email protected]' };
const token = signJWT(userPayload);
console.log('Generated JWT:', token);

Once you've got the token with the custom claims, pass it to the client-side of your app. Use this token when making requests to Supabase.

// Example of setting the token in Supabase client
const supabase = createClient(SUPABASE_URL, SUPABASE_KEY, {
    headers: {
        Authorization: `Bearer ${token}`
    }
});

When you need to access these custom claims in Supabase's server-side functions, use the same JWT library to verify and decode the token. For example, using Node.js:

const jwt = require('jsonwebtoken');

function verifyJWT(token) {
    try {
        const decoded = jwt.verify(token, supabaseSecret);
        console.log('Decoded JWT:', decoded);
        return decoded;
    } catch (err) {
        console.error('JWT verification failed:', err);
        return null;
    }
}

Use this function to decode the JWT and access the custom claims within any server-side logic, middleware, or Supabase functions.

In the Supabase dashboard, go to "Table Editor" and select the table for which you want to set up Row Level Security (RLS) policies. Enable RLS and define policies using SQL to utilize the custom claims.

For example, to leverage the custom role claim:

-- Enable RLS on the table
ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;

-- Create a policy that uses the custom claim
CREATE POLICY "users_can_view_their_data"
ON your_table
FOR SELECT
USING (
    auth.jwt() ->> 'role' = 'admin'
);

This SQL query checks if the role in the JWT is admin for allowing select operations on your_table.

By following these steps, custom JWT claims can be effectively implemented and utilized in Supabase authentication flows.