Alright, first things first, let's get those Supabase client libraries installed. You can use your favorite package manager for this. If you're an npm fan, just run:

npm install @supabase/supabase-js

Or if you prefer yarn, go with:

yarn add @supabase/supabase-js

Next up, we need to initialize the Supabase client in your project. Import the library and create a Supabase client instance. Don't forget to replace YOUR_SUPABASE_URL and YOUR_SUPABASE_KEY with your actual Supabase project URL and public API key.

import { createClient } from '@supabase/supabase-js'

const supabaseUrl = 'YOUR_SUPABASE_URL'
const supabaseKey = 'YOUR_SUPABASE_KEY'

const supabase = createClient(supabaseUrl, supabaseKey)

Now, let's add some custom claims during the sign-up or sign-in process. This usually means working with user metadata when creating a user.

const { user, error } = await supabase.auth.signUp({
  email: '[email protected]',
  password: 'securepassword',
}, {
  data: {
    is_premium: true, // Custom Claim Example
    subscription_type: 'pro' // Another Custom Claim Example
  }
})

In Supabase, the JWT token is signed using a secret. You can update this secret to include custom claims by tweaking Supabase's environment settings.

1. Head over to Settings in the Supabase dashboard.
2. Click on API under settings.
3. Update the JWT_SECRET to include a JSON payload with your custom claims.

For example:

{
  "iss": "your-domain.com",
  "sub": "1234567890",
  "aud": [
    "your-api-audience"
  ],
  "metadata": {
    "is_premium": true,
    "subscription_type": "pro"
  }
}

Make sure to place this updated secret in your environment variable setup for JWT_SECRET.

Now, let's use those custom claims in your database policies for access control. For instance, in Supabase SQL:

-- Allow access only to premium users
create policy "Allow premium users"
on your_table
for select using (
  auth.jwt() ->> 'is_premium' = 'true'
);

This policy checks the is_premium claim in the JWT and grants access based on that condition.

To make sure your custom claims are set correctly, decode the JWT using a JWT decoding tool or library. For example, with jwt-decode in JavaScript:

import jwtDecode from 'jwt-decode';

const jwt = supabase.auth.session()?.access_token
const decoded = jwtDecode(jwt);

console.log(decoded);

Finally, it's time to test and validate everything. Sign in or sign up users and check the JWT to ensure the custom claims are there.

• Sign up a new user.
• Verify that the custom claims show up in the JWT.
• Test your policies to make sure they enforce the custom claims correctly.