"permission denied for table" (42501) after Supabase's 30 October 2026 change

A feature that uses a newly created table fails in your live app with code 42501, even though your AI tool says it is finished. Since Supabase's default change, new tables are not exposed to the Data API until you grant access to them.

What changed

Supabase is changing its default so that new tables in the public schema are no longer exposed to the Data API automatically. It applies to all existing projects from 30 October 2026; Supabase repeated that date on 21 October. It was also announced for new projects from May 2026, but a Supabase CLI change merged in August says that part never landed.

Tables that already existed keep their grants. Only tables created after the change are affected, which is exactly what happens when an AI tool adds a table for a new feature.

The error looks like: permission denied for table <name>, with code 42501. Row-level security can return 42501 too, but with a different message: "new row violates row-level security policy", on an insert or update. A read that row-level security blocks returns no rows instead of an error.

How to fix it

Grant the roles your app uses access to the new table (for example the authenticated role, and anon only if the table is meant to be public), then keep row-level security policies in place.

Ask your AI tool to add the grant to the same migration that creates the table, so future tables do not repeat the problem.

Test the feature in your live app after deploying, not only in the builder's preview.

Can an outside check see this?

No. There is no public signal for a missing grant: only the app's owner can test a table. The free check shows this as a heads-up whenever your app uses Supabase.

Check your app now — free, no sign-up

Paste your app's address and see, from the outside, whether it loads, whether its database is awake, and whether anything here applies to you.

Run the free check

Sources

Checked against these sources on 26 October 2026.