As the sibling comments point out, it uses Postgres Row Level Security (RLS). For an approachable introduction to how Supabase's auth works: https://supabase.c

As the sibling comments point out, it uses Postgres Row Level Security (RLS). For an approachable introduction to how Supabase's auth works: https://supabase.com/docs/guides/auth https://supabase.com/docs/guides/auth > 1. A user signs up. Supabase creates a new user in the auth.users table. > 2. Supabase returns a new JWT, which contains the user's UUID. > 3. Every request to your database also sends the JWT. > 4. Postgres inspects the JWT to determine the user making the request. > 5. The user's UID can be used in policies to restrict access to rows. > Supabase provides a special function in Postgres, auth.uid(), which extracts the user's UID from the JWT. This is especially useful when creating policies. For instance, say you have a `todos` table and want to make it so users can only read their own todos - you could have an RLS policy `todos.user_id = auth.uid()`. Afterward, `SELECT * FROM todos` will only return the authenticated user's todos. (Equivalent to manually issuing `SELECT * FROM todos WHERE todos.user_id = auth.uid()`.) There's also `auth.role()` so you can easily restrict access by role: `auth.role() = "admin"`