Skip to main content

1. Set the key

This publishable key is shared by everyone reading these docs. It identifies the project, not you.
  • Send it on apikey only. It is not a JWT: as Authorization: Bearer it returns Invalid JWT.
  • Authorization is only for a user session. The JS client (createClient(url, publishableKey)) sets apikey for you.
  • Sign in for a bigger ceiling: the sign-in page (GitHub) hands you a user JWT to send as Authorization: Bearer <token> alongside apikey. Tiers: Conventions & limits. Never invent or mint a key.
  • Ignore Secret (sb_secret_…) and legacy service_role: they bypass every boundary. Landing tables are unreachable with the publishable key; Accept-Profile: public answers 401.

2. First call

coverage takes no arguments and says what the warehouse holds:
The response is a plain JSON array, with no envelope:

3. Read a view (GET)

4. Call a function (POST)

Named arguments in a JSON body to POST /rpc/<name>. Names are the SQL parameter names and all start with p_; omit one to take its default.
That is the whole API shape: views you GET, functions you POST.

Next

Conventions & limits

Filter syntax, row caps, nulls, and error codes.

Python SDK

One method per endpoint; a capped response raises; views page.

Panel

The researcher endpoint: mixed ids, mixed metrics, one grain.

Quotes

B3 cash prices, unadjusted, by ticker and session.

Funds

Registry, profile, and monthly NAV by CNPJ.

Notes

  • Sample values in these docs are illustrative shapes, not live prints. Call coverage for what is loaded.
  • If the project exposes several schemas and api is not first, send Accept-Profile: api on GET and Content-Profile: api on POST (including /rpc/). In supabase-js: { db: { schema: 'api' } } or supabase.schema('api').
  • PGRST106 means the schema is not exposed: Supabase Dashboard, Settings, API, Exposed schemas.