How to Update Records in Supabase

Before performing any database operations, you need to create a Supabase client instance. Import createClient from the supabase-js library and pass your project URL and anon key. The anon key is safe to use in client-side code because it respects Row Level Security policies. Never use the service role key in the browser.

1import { createClient } from '@supabase/supabase-js'
2
3const supabase = createClient(
4  process.env.NEXT_PUBLIC_SUPABASE_URL!,
5  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!
6)

Row Level Security must be enabled on your table, and you need an explicit UPDATE policy. Without one, update calls will silently return zero rows — no error is thrown. The policy below allows authenticated users to update only their own rows by comparing auth.uid() to the user_id column. You also need a matching SELECT policy because Supabase must read the row before updating it.

1-- Enable RLS on the table
2alter table public.todos enable row level security;
3
4-- Allow users to read their own rows
5create policy "Users can view own todos"
6  on public.todos for select
7  to authenticated
8  using ((select auth.uid()) = user_id);
9
10-- Allow users to update their own rows
11create policy "Users can update own todos"
12  on public.todos for update
13  to authenticated
14  using ((select auth.uid()) = user_id)
15  with check ((select auth.uid()) = user_id);

Use the .update() method followed by a filter to target one specific row. The update method accepts an object containing only the columns you want to change — unchanged columns are left alone (partial update). Always chain a filter like .eq() to avoid updating every row in the table. Add .select() at the end if you want the updated row returned in the response.

1const { data, error } = await supabase
2  .from('todos')
3  .update({ title: 'Buy groceries', is_complete: true })
4  .eq('id', 1)
5  .select()
6
7if (error) {
8  console.error('Update failed:', error.message)
9} else {
10  console.log('Updated row:', data)
11}

You can update multiple rows at once by using a broader filter. For example, to mark all incomplete todos as complete for the current user, filter by is_complete equals false. The update applies to every row that matches the filter and passes the RLS policy. This is useful for bulk status changes, batch processing, or soft-delete operations.

1const { data, error } = await supabase
2  .from('todos')
3  .update({ is_complete: true })
4  .eq('is_complete', false)
5  .select()
6
7if (error) {
8  console.error('Bulk update failed:', error.message)
9} else {
10  console.log(`Updated ${data.length} rows`)
11}

When you want to insert a new row if it does not exist, or update it if it does, use .upsert() instead of .update(). Upsert checks for conflicts on the primary key or a unique constraint. If a matching row exists, it updates; if not, it inserts. This is particularly useful for syncing external data or handling forms where the user might be creating or editing a record.

1const { data, error } = await supabase
2  .from('todos')
3  .upsert({
4    id: 1,
5    title: 'Buy groceries',
6    is_complete: false,
7    user_id: 'some-user-uuid'
8  })
9  .select()
10
11if (error) {
12  console.error('Upsert failed:', error.message)
13} else {
14  console.log('Upserted row:', data)
15}

Always check both the error object and the returned data. A null error with an empty data array means the row was not found or RLS blocked the operation. Implement proper error handling to surface issues to the user. You can also verify updates by re-fetching the row or using the .select() chain to get the updated record in the same call.

1async function updateTodo(id: number, updates: Record<string, unknown>) {
2  const { data, error } = await supabase
3    .from('todos')
4    .update(updates)
5    .eq('id', id)
6    .select()
7    .single()
8
9  if (error) {
10    throw new Error(`Update failed: ${error.message}`)
11  }
12
13  if (!data) {
14    throw new Error('No row found or RLS policy blocked the update')
15  }
16
17  return data
18}